Subject: [Cfrg] New Randomized Hashing Draft

From: "Hugo Krawczyk" <[email-masked]>
Date: Thu, 25 Oct 2007 17:38:47 -0400

We have submitted a new version of our randomized hashing internet
draft which is posted under
http://www.ietf.org/internet-drafts/draft-irtf-cfrg-rhash-01.txt

Here is the abstract:

   This document describes a randomized hashing scheme consisting of a
   simple message randomization transform that when used as a front-end
   to regular hash-then-sign signature schemes, such as RSA and DSS,
   frees these signatures from their current vulnerability to off-line
   collision attacks against the underlying hash function.  The proposed
   mechanism can work with any hash function as-is and requires no
   change to the underlying signature algorithm. Incorporating this
   mechanism into existing applications requires changes that are
   comparable in their complexity to accommodating a new (deterministic)
   hash function such as SHA-256.

It is worth stressing that the scheme has been simplified considerably
from a first version of this proposal which required the change to
encoding algorithms such as those in PKCS 1. No such change is
required now.

The draft contains a FULL specification and discusses implementation
issues, in particular how to accomodate the extra random salt required
by the scheme. It also reports on several experimental implementations
carried out by different teams.

A web page with detailed information on the scheme including papers on
analysis and implementation can be found in
http://www.ee.technion.ac.il/~hugo/rhash/

The specification in this internet draft is aligned with NIST's recent
Special Publication 800-106 (Draft) "Randomized Hashing Digital
Signatures"
http://csrc.nist.gov/publications/drafts/Draft-SP-800-106/Draft-SP800-106.pdf
that describes the same scheme. The main difference in our spec is
that we allow for some optimizations for specific hash families (most
notably Merkle-Damgard).

We welcome comments, especially any feedback related to the
suitability of the technique for specifc applications and potential
interest in specific IETF WGs.

Please send comments to the authors (cc-ed above) or via the cfrg mailing list.

Hugo

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg