Re: [saag] Revision of "Attacks on Cryptographic Hashes in Internet Protocols"

["David McGrew (mcgrew)" <[e-mail]>]

Hi Paul,

A quick comment.   The draft says that uses for hash algorithms include

   o  Integrity protection.  It is common to compare a hash value that
      is received out-of-band for a file with the hash value of the file
      after it is received over an unsecured protocol such as FTP.

... and it then says that collision resistance is not needed for the
integrity protection use case.   However, it seems to me that there are
possible threats against hash-based integrity protection that would be
possible if the person/system generating the hash can generate collisions,
and is untrustworthy.  Consider the case of an md5sum hash on a debian ISO
image.  If the person responsible for generating the hash can create a
malware-laden ISO imagine that has a hash collision with the actual ISO
image, then they could substitute the bad one for the good one regardless
of the hash checking step.  An attacker might leave the good ISO image in
place to avoid detection, while foisting the bad one on some victims.  I
am assuming that there are different ways of distributing ISO images, or
that the substitution of bad for good can take place after the good one
has been investigated and found to be good.

It is debatable how important this scenario is in practice, but it seems
that collision resistance is at least desirable for integrity protection.

David

P.S. - apologies for picking on debian, which is a most excellent distro
:-)