Subject: Re: How to Calculate Signatures?

From: [email-masked] ("Hal Finney")
Date: Sun, 3 Apr 2005 12:45:40 -0700 (PDT)

Ben Laurie writes:
> The hash does include the ID of the hash, and hence the signature does.

Unfortunately, that doesn't protect against the attack.  The ID of SHA-1
is 2 and the ID of RIPEMD-160 is 3.  If SHA-1 were broken badly enough
it's entirely possible that we could find m1 and m2 such that:

SHA1 (2 || m1) == RIPEMD160 (3 || m2).

The mere fact that you feed the hash algorithm ID into the hash algorithm
doesn't stop you from finding collisions with a different, broken hash
algorithm.

The situation is different with RSA, where you do:

RSA_Sign (Alg ID || Hash).

Now, it is impossible to get collisions using two different algorithm ID's
because the algorithm ID is outside the hash.

Hal

---

From: Ian G <[email-masked]>
Date: Sun, 03 Apr 2005 22:26:10 +0100

> doesn't stop you from finding collisions with a different, broken hash

Which would seem to be mildly supportive of locking
DSA with SHA1?

> because the algorithm ID is outside the hash.

And this would seem to suggest that rather than
tinkering with DSA, we should prefer a completely
new signature algorithm?

iang

-- 
News and views on what matters in finance+crypto:
         http://financialcryptography.com/