torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

delete trailing whitespace in xxx-what-uses-sha1.txt

Browse Source
This commit is contained in:
Nick Mathewson
2009-05-02 11:49:45 -05:00
parent 4f9b12e248
commit 08e4a07720
1 changed files with 18 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/spec/proposals/ideas/xxx-what-uses-sha1.txt
+18 -18
View File
@@ -15,10 +15,10 @@ Introduction:
too long.
According to smart crypto people, the SHA-2 functions (SHA-256, etc)
share too much of SHA-1's structure to be very good. RIPEMD-160 is
also based on flawed past hashes. Some people think other hash
functions (e.g. Whirlpool and Tiger) are not as bad; most of these
have not seen enough analysis to be used yet.
share too much of SHA-1's structure to be very good. RIPEMD-160 is
also based on flawed past hashes. Some people think other hash
functions (e.g. Whirlpool and Tiger) are not as bad; most of these
have not seen enough analysis to be used yet.
Here is a 2006 paper about hash algorithms.
http://www.sane.nl/sane2006/program/final-papers/R10.pdf
@@ -91,29 +91,29 @@ What Tor uses hashes for today:
A. All signatures are generated on the SHA-1 of their corresponding
documents, using PKCS1 padding.
* In dir-spec.txt, section 1.3, it states,
"SIGNATURE" Object contains a signature (using the signing key)
of the PKCS1-padded digest of the entire document, taken from
the beginning of the Initial item, through the newline after
* In dir-spec.txt, section 1.3, it states,
"SIGNATURE" Object contains a signature (using the signing key)
of the PKCS1-padded digest of the entire document, taken from
the beginning of the Initial item, through the newline after
the Signature Item's keyword and its arguments."
So our attacker, Malcom, could generate a collision for the hash
that is signed. Thus, a second pre-image attack is possible.
So our attacker, Malcom, could generate a collision for the hash
that is signed. Thus, a second pre-image attack is possible.
Vulnerable to regular collision attack only if key is stolen.
If the key is stolen, Malcom could distribute two different
If the key is stolen, Malcom could distribute two different
copies of the document which have the same hash. Maybe useful
for a partitioning attack?
B. Router descriptors identify their corresponding extra-info documents
by their SHA-1 digest.
* A third party might use a second pre-image attack to generate a
false extra-info document that has the same hash. The router
itself might use a regular collision attack to generate multiple
extra-info documents with the same hash, which might be useful
* A third party might use a second pre-image attack to generate a
false extra-info document that has the same hash. The router
itself might use a regular collision attack to generate multiple
extra-info documents with the same hash, which might be useful
for a partitioning attack.
C. Fingerprints in router descriptors are taken using SHA-1.
* The fingerprint must match the public key. Not sure what would
happen if two routers had different public keys but the same
* The fingerprint must match the public key. Not sure what would
happen if two routers had different public keys but the same
fingerprint. There could perhaps be unpredictable behaviour.
D. In router descriptors, routers in the same "Family" may be listed
D. In router descriptors, routers in the same "Family" may be listed
by server nicknames or hexdigests.
* Does not seem critical.
E. Fingerprints in authority certs are taken using SHA-1.