Subject: RE: Protecting Against Weak Hash Algorithms

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 21 Sep 2006 03:51:47 -0700

Paul,

Let us say that you as a signer is using SHA-1 and RSA.  I thought I can
keep your signature, but create a payload using a weak hash scheme (say
MD-4 or chokhani Hash) that is still lying in the relying party system.
Since the identification of the hash algorithm to be used in
verification lies with the payload, pointing to the weak hash OID will
be part of creation of the material.

Thus, SHA-1 need not be weak.  Only the relying party system needs to
invoke a weak hash algorithm.  

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: Wednesday, September 20, 2006 11:36 PM
To: Santosh Chokhani; [email-masked]
Subject: Re: Protecting Against Weak Hash Algorithms

At 12:09 PM -0700 9/20/06, Santosh Chokhani wrote:
>I think we should have a debate on security issues surrounding weak 
>hashes, specifically relying parties snookered into verifying a 
>signature using a weak hash that can easily create collision with 
>payload that was actually signed using a strong hash.

I am confused by the terminology used here. How can a message created 
by one hash easily create a collision with a message created with 
another hash? That would indicate an equal weakness in both hashes, 
wouldn't it?

Could you lay out a specific example?

--Paul Hoffman, Director
--VPN Consortium

---

From: Wan-Teh Chang <[email-masked]>
Date: Thu, 21 Sep 2006 07:10:41 -0700

> be part of creation of the material.

If I understand you correctly, your proposal is useful
for DSA and ECDSA signatures because the (r, s) components
don't tell you what hash algorithm should be used.  On
the other hand, your proposal isn't necessary for PKCS #1
v1.5 RSA signatures because the hash algorithm is also
encrypted along with the hash.

Seems like the attack you want to protect against also
requires that the weaker hash algorithm's output is the
same length as the hash algorithm used in the original
signature.  Right now MD2, MD4, and MD5 are probably
the only such hash algorithms(all 128 bits long).  But
none of these can be used with DSA and ECDSA.

Wan-Teh

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 21 Sep 2006 19:21:48 -0700

>MD-4 or chokhani Hash) that is still lying in the relying party system.

I think that is only true if "weak" means susceptible to a preimage 
attack, not to the collision attacks we have been seeing. To date, 
none of the hash functions in use have been shown to be susceptible 
to exploitable preimage attacks.

Also, it is only true if the output size of the two hashes are the same, yes?

--Paul Hoffman, Director
--VPN Consortium