IETF Logo Mail Archive

Re: [saag] Revision of "Attacks on Cryptographic Hashes in Internet Protocols"

Mouse <mouse@Rodents-Montreal.ORG> Wed, 28 November 2012 21:32 UTC

Return-Path: <mouse@Sparkle.Rodents-Montreal.ORG>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2800F21F847B for <saag@ietfa.amsl.com>; Wed, 28 Nov 2012 13:32:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.988
X-Spam-Level:
X-Spam-Status: No, score=-9.988 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RTCfV61ktuui for <saag@ietfa.amsl.com>; Wed, 28 Nov 2012 13:32:28 -0800 (PST)
Received: from Sparkle.Rodents-Montreal.ORG (Sparkle.Rodents-Montreal.ORG [216.46.5.7]) by ietfa.amsl.com (Postfix) with ESMTP id 735A521F8453 for <saag@ietf.org>; Wed, 28 Nov 2012 13:32:28 -0800 (PST)
Received: (from mouse@localhost) by Sparkle.Rodents-Montreal.ORG (8.8.8/8.8.8) id QAA14540; Wed, 28 Nov 2012 16:32:22 -0500 (EST)
Date: Wed, 28 Nov 2012 16:32:22 -0500
From: Mouse <mouse@Rodents-Montreal.ORG>
Message-Id: <201211282132.QAA14540@Sparkle.Rodents-Montreal.ORG>
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway.
X-Message-Flag: Microsoft: the company who gave us the botnet zombies.
X-Composition-Start-Date: Wed, 28 Nov 2012 16:29:49 -0500 (EST)
To: saag@ietf.org
In-Reply-To: <747787E65E3FBD4E93F0EB2F14DB556B0F54B22B@xmb-rcd-x04.cisco.com>
References: <747787E65E3FBD4E93F0EB2F14DB556B0F54B22B@xmb-rcd-x04.cisco.com>
Subject: Re: [saag] Revision of "Attacks on Cryptographic Hashes in Internet Protocols"
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/saag>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Nov 2012 21:32:29 -0000

> Consider the case of an md5sum hash on a debian ISO image.  If the
> person responsible for generating the hash can create a malware-laden
> ISO imagine that has a hash collision with the actual ISO image,

...then you're dealing with second-preimage reisistance, not just
collision resistance.

At least, unless the "actual ISO image" creator is in on the deal, and
in that case even the best hash imaginable won't help.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		mouse@rodents-montreal.org
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

v2.23.0 | Report a Bug | By Email