[193790] in North American Network Operators' Group
Re: SHA1 collisions proven possisble
daemon@ATHENA.MIT.EDU (valdis.kletnieks@vt.edu)
Thu Feb 23 21:08:14 2017
X-Original-To: nanog@nanog.org
From: valdis.kletnieks@vt.edu
X-Google-Original-From: Valdis.Kletnieks@vt.edu
To: "Patrick W. Gilmore" <patrick@ianai.net>
In-Reply-To: <15B18A41-8051-418E-8BC3-2749590A54F6@ianai.net>
Date: Thu, 23 Feb 2017 21:08:03 -0500
Cc: NANOG list <nanog@nanog.org>
Errors-To: nanog-bounces@nanog.org
--==_Exmh_1487902083_9506P
Content-Type: text/plain; charset=us-ascii
On Thu, 23 Feb 2017 20:56:28 -0500, "Patrick W. Gilmore" said:
> According to the blog post, you can create two documents which have the same
> hash, but you do not know what that hash is until the algorithm finishes. You
> cannot create a document which matches a pre-existing hash, i.e. the one in the
> signed doc.
You missed the point. I generate *TWO* documents, with different terms but the
same hash. I don't care if it matches anything else's hash, as long as these two
documents have the same hash. I get you to sign the hash on the *ONE* document I present to you
that is favorable to you. I then take your signature and transfer it to the
*OTHER* document.
No, I can't create a collision to a document you produced, or do anything to a
document you already signed. But if I'm allowed to take it and make "minor
formatting changes", or if I can just make sure I have the last turn in the
back-and-forth negotiating... because the problem is if I can get you to sign a
plaintext of my choosing....
--==_Exmh_1487902083_9506P
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Comment: Exmh version 2.5 07/13/2001
iQEVAwUBWK+Vg40DS38y7CIcAQINJAgAgqBD58xSNB72h2od4qhjv6uuNEwbFf7s
zww50xKQb4cUJXpyDf7xJP1YNmqzidSagAHwfR8TZb8L8K2ZsWO9OEOICx8454lf
1IgmuPxYfCx2hfWn5569eD3OpUHe+FB0SyS5bb682HzrauySmDFbFL4jmXgFAIcw
oJ353Otu6ZxvpWx6h0oPUAqdyS6319wqEchM8NUFYZgN+mfarP+qkIZPhGFXTNNq
2lxS06zNApWxONoXDZp01Yjd5DqwwDYMp5B08FozrWaeM3kg4zT69ieJ1ohk65HL
bKdMFX0jq+3vcWWdYAiC4kOd3RjMhoW7HoqYWvdttTII+gaG5PkKBA==
=x34W
-----END PGP SIGNATURE-----
--==_Exmh_1487902083_9506P--
