[Plants] Re: Higher forgery resistance almost for free?

[Andreas Hülsing <[e-mail]>]

Hi all,

This sounds like a sensible solution for the case that the attacker is 
an external user, not the CA. In that case, the attack cost behaves 
indeed as discussed in this thread and will require a malicious user to 
do in the order of 2^256 work for a random oracle (or slightly less for 
the case of SHA256 due to the issue with the Antonov attack). As 
correctly pointed out by Victor, this will not help against a malicious 
or corrupted CA (remember DigiNotar) as to them the randomizer cannot 
only be chosen, but it even allows them to freely chose it (which, as 
this value afaikt is not authenticated besides being included in the 
hash, gives the CA a straight-forward degree of freedom to search for 
colliding, meaningful cert hashes).

Cheers,

Andreas