[78170] in cryptography@c2.net mail archive
length-extension and Merkle-Damgard hashes
daemon@ATHENA.MIT.EDU (Travis H.)
Tue Jan 30 11:36:27 2007
X-Original-To: cryptography@metzdowd.com
Date: Sun, 28 Jan 2007 13:33:30 -0600
From: "Travis H." <travis+ml-cryptography@subspacefield.org>
To: Cryptography <cryptography@metzdowd.com>
Mail-Followup-To: Cryptography <cryptography@metzdowd.com>
--cNdxnHkX5QqsyA0e
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
So I was reading this:
http://en.wikipedia.org/wiki/Merkle-Damgard
It seems to me the length-extension attack (given one collision, it's
easy to create others) is not the only one, though it's obviously a
big concern to those who rely on it.
This attack thanks to Schneier:
If the ideal hash function is a random mapping, Merkle-Damgard hashes
which don't use a finalization function have the following property:
If h(m0||m1||...mk) =3D H, then h(m0||m1||...mk||x) =3D h(H||x) where the
elements of m are the same size as the block size of the hash, and x
is an arbitrary string. Note that encoding the length at the end
permits an attack for some x, but I think this is difficult or
impossible if the length is prepended.
--=20
The driving force behind innovation is sublimation.
-><- <URL:http://www.subspacefield.org/~travis/>
For a good time on my UBE blacklist, email john@subspacefield.org.
--cNdxnHkX5QqsyA0e
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.1 (OpenBSD)
iQIVAwUBRbz6imQVZZEDJt9HAQIcJhAAk4mrivkuqupj8Qz9H+bJHpwcdsmeSBF5
ElqLaDmEFhnq0EsvnVwOIARwJYYTK+eScVZhidFrjFEHdwhW05y8wMiJD/nvnbNC
I/TbYFaFA5aO7rUTJ1ZQpNhq04eJBQAwdgqy2GCzgVBgRihUVDLVNC0hCEPyzK+n
w4EoGqw/UNJLBqgddxr/xfU9dYBSM+bbnAEkNHArN5ea/aC5+QhTG1xleJNz5TIC
y4V+XqUyodCE2YP/5+iV2TYTH+NUezViLlri7S3PhFFDib5+VJsZkMNzWmObCu0x
qlkHbEzSB1F2E9ki6d6AXSy9K7kRcoqNG9XExW1Yhtd0MuzasRBU9VhRPpEx4J2x
LZ1Oe+FNhXHdqh0Cv1hWisNEUtlyEM7veB4xVG6jr4qgfvoEXK8tQQ5J/4eEXmKu
EbaVJ5wcrdmfUqObSNC76S+7goLrkcPrGBuTxA8cIb4u5Dj7iMR5W+FtwYLztOR0
WlZ1Zzs0y6CNC3n3A7ElA2CoXPjCTyaRr+T4Ee+KvYgEmaMhnsAH14fiFORxJFfm
b5Tl97o0uQBEDee+xCRvcTRbtzkpa2gBT58FKkf3SdtbGtFdxqhWz5tono1M0UGZ
B5pD4aRU+6aw3JNDqFQRwBPVdY2EiLeKUefgzjsJKqcRqtfmIjwfiYixZZxQjdVc
3zFqcoX9qL0=
=LopZ
-----END PGP SIGNATURE-----
--cNdxnHkX5QqsyA0e--
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
