| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 21 Feb 2005 11:02:08 +0000 From: Paul Johnston <paul@...tpoint.ltd.uk> To: securityfocus@...rotechnical.co.uk Cc: bugtraq@...urityfocus.com Subject: Re: SHA-1 broken Hi, >In much the same way if the original text was 'I owe you 1 million dollars' and the collision text was 'sdf86*&6989h,mni lkj99j' its not significant. > > I think that kind of collision affects the "non-repudiation" property of digital signatures. In court, A produces message "I owe you 1 million dollars" signed by B. B says, "No... I signed a random string provided by A to prove my identity, I've been setup to sign this colliding message". Regards, Paul -- Paul Johnston, GSEC Internet Security Specialist Westpoint Limited Albion Wharf, 19 Albion Street, Manchester, M1 5LN England Tel: +44 (0)161 237 1028 Fax: +44 (0)161 237 1031 email: paul@...tpoint.ltd.uk web: www.westpoint.ltd.uk
Powered by blists - more mailing lists