On Sat, 24 Mar 2007 11:48:10 CDT, wac said: > Of course not, is enough to find a collision and you'll get for example a > message signed by somebody else that looks completely authentic since > signatures encrypt that hash with the private key. No, if you have a signature to some text, you need to find a collision to a specified value - the one the signature covers. For instance, if you have a 16 bit hash, finding two texts that both have a hash value of 0x1F6E doesn't do you much good if the signature is for 0x4ED2. And due to the birthday paradox, finding any pair of colliding hashes is a lot easier than finding a collision to a specific hash. And being able to force a collision to a specific hash may not be very useful all by itself - for instance, if you're trying to collide the hash that the PGP signature covers in this message, you *might* be able to find a string of bits. But you won't be able to make it a *plausible* signature unless your string of bits is *also* a chunk of English text, that reads as if I wrote it. So not only do you need to be able to collide a specific hash, you need to do so with at least *some* control over the content of the text, which is even harder.
Attachment:
pgpfuhU9wvaAM.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/