Re: [saag] Revision of "Attacks on Cryptographic Hashes in Internet Protocols"

[Steven Bellovin <[e-mail]>]

On Nov 28, 2012, at 5:29 PM, David McGrew (mcgrew) <[e-mail]> wrote:

> 
> 
> On 11/28/12 4:32 PM, "Mouse" <[e-mail]> wrote:
> 
>>> Consider the case of an md5sum hash on a debian ISO image.  If the
>>> person responsible for generating the hash can create a malware-laden
>>> ISO imagine that has a hash collision with the actual ISO image,
>> 
>> ...then you're dealing with second-preimage reisistance, not just
>> collision resistance.
>> 
>> At least, unless the "actual ISO image" creator is in on the deal, and
>> in that case even the best hash imaginable won't help.
> 
> The point that I wanted to make is: if the actual ISO image creator is
> untrustworthy and the hash function is not collision resistant, then it is
> possible for that person to make two images, one good and one bad.   This
> enables attacks on the system that are not otherwise possible, i.e.
> publishing the good image in the distribution channels that will actually
> be checked by security auditors, then publishing the bad one in some other
> distribution channels.
> 

What about the party who prepares part of the contents, i.e., one file?
The hash function reaches that file with fixed but unknown internal state.
It's easy to prepare two different files that would cause a collision from
the standard starting state, but I'm not sure about this scenario.


		--Steve Bellovin, https://www.cs.columbia.edu/~smb