full-disclosure - Re: Chinese Professor Cracks Fifth Data Security Algorithm (SHA-1)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 22 Mar 2007 01:30:20 +0300
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: Tim <tim-security@...tinelchicken.org>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Chinese Professor Cracks Fifth Data Security
	Algorithm (SHA-1)

Dear Tim,

--Wednesday, March 21, 2007, 7:24:35 PM, you wrote to full-disclosure@...ts.grok.org.uk:

T> Secondly, 3APA3A, birthday attacks against the collision-resistance
T> property of a hash take approximately 2^(b/2) time, where b is the
T> number of bits.  That is, brute-force birthday attacks would take around
T> 2^80 time against SHA-1.  These attacks reduce the complexity to 2^63,
T> or thereabouts, at least from what I've read previously[1].

Yes,  I  was wrong. I thought "2000 times" applies to direct bruteforce,
not to birthday attack. In this case complexity estimations for birthday
attack  may  be ~2^74, an equivalent for birthday attack against 148 bit
hash.

T> As for US courts... which case are you referring to (as I'd be
T> interested to read the results)?  The only one I know of involving MD5
T> was an Australian case[2].

And again yes, it was really Australian case.

T> cheers,
T> tim

T> 1. http://www.schneier.com/blog/archives/2005/08/new_cryptanalyt.html

T> 2. http://news.com.com/2061-10789_3-5829714.html

-- 
~/ZARAZA http://securityvulns.com/
Таким образом он умирает в шестой раз - и опять на новом месте. (Твен)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/