Subject: RE: Protecting Against Weak Hash Algorithms

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 22 Sep 2006 03:26:58 -0700

Paul,

See responses in-line.

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: Thursday, September 21, 2006 10:22 PM
To: Santosh Chokhani; [email-masked]
Subject: RE: Protecting Against Weak Hash Algorithms

At 3:51 AM -0700 9/21/06, Santosh Chokhani wrote:
>Let us say that you as a signer is using SHA-1 and RSA.  I thought I
can
>keep your signature, but create a payload using a weak hash scheme (say
>MD-4 or chokhani Hash) that is still lying in the relying party system.

I think that is only true if "weak" means susceptible to a preimage 
attack, not to the collision attacks we have been seeing. To date, 
none of the hash functions in use have been shown to be susceptible 
to exploitable preimage attacks.
[Santosh Chokhani] Yes.

Also, it is only true if the output size of the two hashes are the same,
yes?
[Santosh Chokhani] I do not think so.  See the Kaliski paper I cited.

--Paul Hoffman, Director
--VPN Consortium

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 22 Sep 2006 07:11:35 -0700

If the only way to trigger this problem is to find a hash function 
that (a) is used in a certificate in someone's store of trust anchors 
and (b) is susceptible to a preimage attack and (c) no one has 
suggested any practical preimage attacks on those hash functions, 
then I am against changing the signature format for this attack.

If the attacker can create a preimage, they will do so for the the 
trusted root; this will take much less effort than creating a 
preimage that will match a valid message for a different trust 
anchor. Few applications that handle multiple trust anchors show the 
user which trust anchor is being used at the time of validation. 
Thus, an attacker would have many ripe targets without having to do 
the extra work of getting one message to match another from a 
"better" trust anchor.

Further, even if we decided that this was an actual problem, there 
are many other proposed changes to the signature structure that would 
both eliminate this attack and others at the same time. We don't get 
to change signature structures often; doing it for this minor case 
seems like a waste of effort.

--Paul Hoffman, Director
--VPN Consortium