PGP Moving To Stronger SHA Algorithms

Not a solution by Esine · 2005-02-20 09:02 · Score: 4, Insightful

They're just trying to avoid the problem, not solve it. Moving to SHA-512 is not a solution. :/

Re:Not a solution by anothergene · 2005-02-20 09:06 · Score: 5, Insightful

They're just trying to avoid the problem, not solve it. Moving to SHA-512 is not a solution. :/

Could also be a stop gap solution. At least it will be harder to break in the mean time until a real solution is devised.

--
Who's leg do I have to hump to get a dry martini around here?
Re:Not a solution by Storlek · 2005-02-20 09:09 · Score: 2, Insightful

What solution is there? Moving to a stronger hashing algorithm is surely better than doing nothing at all.

--
Bears don't normally eat things that talk and move backwards.
Re:Not a solution by Anonymous Coward · 2005-02-20 09:15 · Score: 5, Insightful

What, then, is?

Moving to Tiger? Or Whirlpool? Or RIPEMD-160?

The amount of effort it took to discover the weakness in SHA-1 was incredible, and SHA-256 and SHA-512 are even more complex. Tiger and Whirlpool are relatively untested, and RIPEMD-160 was put out as an update after the original RIPEMD was broken (Much like SHA-0).

SHA-256 and SHA-512 are the most likely successors to the throne, because they're based on an algo that is STILL, despite being "broken", known to have very strong collision resistance.
Re:Not a solution by Mr2cents · 2005-02-20 09:20 · Score: 4, Interesting

Why not sign using two hashes? You'll need to find a chunk of data that generates two collisions with two different hashing algorithms. Let'em chew on that one!

--
"It's too bad that stupidity isn't painful." - Anton LaVey
Re:Not a solution by CajunArson · 2005-02-20 09:31 · Score: 4, Informative

I do see your point, but remember that you could argue the RSA is useless because if I did it over a 32 bit address space it's easy to prime-factorize any number and therefore increasing it to a 2048 bit space is "just avoiding the problem". As CPU power increases it becomes more economical to move to more complex hash/ecryption schemes over larger address spaces. And there's even good news: it's a hell of a lot cheaper for me to move my PC to a new SHA system than it will be to crack it, even with the algorithm issues.

--
AntiFA: An abbreviation for Anti First Amendment.
Re:Not a solution by Eravnrekaree · 2005-02-20 09:40 · Score: 3, Informative

It seems like the way to fix the problem (make the encrypted data difficult enough to decode using brute force methods) is to move up to stronger algorithms. This happens continuously, it doesnt mean that the old alogorithm was initially flawed, but rather it has become obsolete due to increasing computing power. As computing power increases, this means it takes less time to decode an algorithm using a trail and error brute force process.

The user should be able to choose from several algorithms depending on their needs, their are tradeoffs for each. A stronger one will require more computing power but will be more difficult to decode using a brute force attack, and will tend to last longer agianst increasing processing power of computers. A weaker one will be much faster but also it is more trivial to decode it with a brute force attack, and as computing power increases it will become more trivial to decode via an attack. Thus there is a constant interaction between CPU speed and algorithms, as faster CPUs arise, this means stronger algorithms are needed as the older ones which were too impractical to easily attack on older CPUs have become trivial to decode on newer CPUs. However, since the CPUs have since become faster, it also means that it takes less time to encrypt the data in any particular algorithm, so while stronger algorithms are needed due to increasing CPU power, those algorithms also become more practical due to increasing CPU power.
Re:Not a solution by Dolda2000 · 2005-02-20 09:50 · Score: 4, Informative

It's the same solution that's been used with RSA for ages. When 512-bit keys were broken, 1024-bit keys were recommended. Now when they're almost broken, 2048-bit keys are recommended. I hear that some are already recommending 4096-bit keys.
There's no fool-proof "solution" to this problem. The key (no pun intended) is to keep a high enough ratio between hash length (or key length) and the kind of processing power that potential crackers (including the NSA) can be thought to have access to.
Thus, as the processing power of the world increases, so do we increase the hash/key lengths. There's nothing strange about that, if you ask me -- especially considering how the required processing power increases exponentially with the hash/key length in use.
Re:Not a solution by Anonymous Coward · 2005-02-20 10:30 · Score: 5, Informative

As it turns out PGP (well, GPG) already has support for RIPEMD160 built in to it. To use this:
gpg --clearsign --digest-algo RIPEMD160 foo.txt
gpg -b --armor --digest-algo RIPEMD160 foo.tar.gz

(First one: Clear signuatre; second one: detached signature)
Re:Not a solution by Dolda2000 · 2005-02-20 11:32 · Score: 3, Informative

I've already replied to a similar question.
In short, having two different hashes doesn't add more security (at least not significantly more) than just doubling the hash length.
Re:Not a solution by uhoreg · 2005-02-20 11:50 · Score: 4, Insightful
1. SHA-256 is not just SHA-1 with more bits; it's a different algorithm. So moving from SHA-1 to SHA-256 is not the same as moving from RSA-512 to RSA-1024. (However, moving from SHA-256 to SHA-512 would be.)
2. RSA was never broken in the same way that SHA-1 is now (allegedly -- since the paper is not yet published) broken, or that MD5 is broken. SHA-1 is broken in the sense that the researchers were able to find a collision in much less than the expected 2^80 calculations. This indicates that the algorithm is weaker than previously believed, and may soon result in much quicker attacks. RSA-512 is broken because computing power has caught up with it, and it's possibly economical to build a computer that can crack 512-bit RSA keys. Weaknesses that are solely due to key/hash size may be fixed by switching to a larger size. Weaknesses that are inherent in the algorithm may not be able to be fixed in this way.
--
To get something done, a committee should consist of no more than three persons, two of them absent.
Re:Not a solution by Anonymous Coward · 2005-02-20 11:55 · Score: 2, Interesting

having two different hashes doesn't add more security (at least not significantly more) than just doubling the hash length

Sure it does, because you're talking about two different algorithms. If a fatal flaw is found in one algorithm, you're still left with *something*, vs. being left with no pants.
Re:Not a solution by theLOUDroom · 2005-02-20 12:13 · Score: 2, Informative

I do see your point, but remember that you could argue the RSA is useless because if I did it over a 32 bit address space it's easy to prime-factorize any number and therefore increasing it to a 2048 bit space is "just avoiding the problem".

You are comparing apples to oranges.
We're talking about a mathematical breakthrough, not the release of the newest processor.

This problem isn't arising because we have faster processors, it's arising because someone has discovered a fundamental flaw in the algorithm. Sure you can take your chances and hope that this work won't beget more research which shows that SHA-1 can be comprimised even easier than we think now, but that would just make me think you weren't paying attention during the whole MD5 situation.

First somebody finds a chink in the armor.

The next person punches right through it.

Maybe somebody won't be able to take this finding any further, but I think it definately hasn't been out there long enough to be able to say that yet. Worry that someone else will be able to take this reseach and the newfound insight into the algorithm that it provides to show that SHA-1 is even less ecure than we think now.

--
Life is too short to proofread.
Re:Not a solution by vagabond_gr · 2005-02-20 12:14 · Score: 2, Informative

Such use-whatever-you-can solutions can indeed make intruder's life harder, but cannot offer true security. Even using two algorithms concurrent collisions will exist (due to the infinite number of collisions for each algorithm). If someone can find collisions for each hash function, nothing can guarantee that he will not find one for both. The problem is that the algorithm's security foundations are shaken, so we can no longer trust it.

It's like using two passwords instead of one. Of course it's better, but it can only slow down an attacker who knows how to break passwords.
Re:Not a solution by uhoreg · 2005-02-20 12:30 · Score: 2, Funny

Yes, you are right. I will blame a brain hiccup.

--
To get something done, a committee should consist of no more than three persons, two of them absent.
Re:Not a solution by darkonc · 2005-02-20 13:06 · Score: 2, Insightful

Sure it does, because you're talking about two different algorithms.
Not really. SHA1+MD5 can be expressed as a singular algorithm that produces the combined signature.... thing is, you now end up with one algorithm broken in two different ways that may actually allow for an easier breakage down the road (it's a bit harder to predict, given that you're now looking at a relatively ad-hock concatonation).
It's not that it's a known breakage -- rather that you're now looking at a very ad-hock union that hasn't been carefully designed. In some ways, it's better to go with widening the key on a well designed system with known breakage than to go with an ad-hock system with unknown properties (other than two different kinds of classes of known holes).

--
Sometimes boldness is in fashion. Sometimes only the brave will be bold.

Why only small improvements in security? by ABeowulfCluster · 2005-02-20 09:02 · Score: 5, Funny

I think I'll wait for the SHA-65000 algorithm instead.. it'll be harder to crack.

Re:Why only small improvements in security? by Jarvo · 2005-02-20 12:46 · Score: 3, Funny

Bah. RSA-640k should be enough key length for everybody.

Come on... by debilo · 2005-02-20 09:03 · Score: 4, Informative

... who broke the SHA-1 algorithm.

They did not break it. They just found a way to reduce the number of trials needed to find a collision.

Re:Come on... by no+parity · 2005-02-20 09:07 · Score: 5, Insightful

They did not break it. They just found a way to reduce the number of trials needed to find a collision.
That is what's usually referred to as "breaking" a hash algorithm.
Re:Come on... by Anonymous Coward · 2005-02-20 09:08 · Score: 2, Insightful

They did not break it. They just found a way to reduce the number of trials needed to find a collision.

And what exactly would you consider broken? Since when was "it don't work as we thought" not good enough?

Let me give you an example. You sign your Last Will and Testament digitally. You can do that; the courts will uphold it. Now, these fine researchers can concoct a new Will that says something different, but still appears to be signed by you.

Of course you already knew they could do that, but you thought it would take 20 million or so years. As it turns out, your estimate was several orders of magnitude too high. That's what these researchers have proven.

Is SHA-1 broken yet?
Re:Come on... by octaene · 2005-02-20 09:11 · Score: 4, Informative

Finally, someone who has a clue! no parity is absolutely right. All they did was provide a hash that produces 1 collision as a proof that they have an algorithm that makes finding collisions easier. This doesn't mean we all need to rush out and change our public/private keys...
Re:Come on... by slavemowgli · 2005-02-20 09:13 · Score: 2, Insightful

From a cryptography point of view, that *is* breaking it.

--
quidquid latine dictum sit altum videtur.
Re:Come on... by abelsson · 2005-02-20 09:16 · Score: 3, Interesting

No, they did indeed break it. An attack is now practical for a well funded adversary, where it wasn't before - practical attacks being known is the very definition of when a cryptographic algorithm is considered broken.
Re:Come on... by sahonen · 2005-02-20 09:27 · Score: 2, Interesting

Okay, even if you can find a collision in, say, a day... Great. You can find a collision in a day. But how many collisions will you have to sort through before you find one that even resembles a will, especially one that, say, gives all your property to me?

--
Make me a friend and I'll mod you up
Re:Come on... by menscher · 2005-02-20 09:29 · Score: 4, Informative

All they did was provide a hash that produces 1 collision
No, they didn't. No hash has been produced. Only a claim that they can do it in 2^69 operations. The collisions they gave were for SHA-0 and for a reduced-round version (58 rounds instead of 80) of SHA-1. Unless someone can extend the break (which is likely) then it's still quite secure.
Re:Come on... by menscher · 2005-02-20 09:33 · Score: 2, Interesting

No, it's not practical for a well-funded adversary. Their attack only made it 2048 times easier. That's not particularly significant, in itself. What *is* significant is that it suggests that other attacks might be possible. But as it stands, SHA-1 is quite secure.
Fighting the FUD....
Re:Come on... by Anonymous Coward · 2005-02-20 09:37 · Score: 4, Insightful

Okay, even if you can find a collision in, say, a day... Great. You can find a collision in a day. But how many collisions will you have to sort through before you find one that even resembles a will, especially one that, say, gives all your property to me?

Oh, sure, lots. But if the SHA-1 is being used for, say, passwords - where all that's stored and checked is the hash - then ANY collision will do. So if you can find a collision in a day, you can break into any system using SHA-1 for password authentication in a day.

That's broken.
Re:Come on... by abelsson · 2005-02-20 09:49 · Score: 4, Interesting

Bruce Schneier estimates that a SHA-1 collision finding machine, built along the same lines as the old DES cracker would cost $25M-$38M and could do the needed 2^69 calculations in 56 hours. distributed.net has already completed a 2^64 operation challenge a few years ago, which along with Moores law puts 2^69 ops into the realm of the possible.

Fighting the FUD, indeed.
Re:Come on... by CastrTroy · 2005-02-20 10:00 · Score: 3, Insightful

Didn't they already prove this broken by creating a database of all hashes possible for all alpha-numeric passwords up to a certain length. I think it was for a different hash though. Anyway, if you're going to spend all the computation power to break passwords, you might as well just make a reverse hash database, it will be much more useful to you.

--

Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Re:Come on... by Anonymous Coward · 2005-02-20 10:02 · Score: 2, Interesting

They didn't produce a hash, they produced a technique better than brute force for producing arbitrary hashes.

The way you describe it makes it sound like they stumbled upon a collision.
Re:Come on... by kiltedtaco · 2005-02-20 10:14 · Score: 4, Informative

MD5 and SHA-1 are both iterated hashes. They work by take one block, hash it, then use the output from that round as the IV for hashing the next. This allows a curious sort of failure:

The attack on MD5 worked independently from the initial state of the cipher, i.e., any arbitrary message could be prepended to the calculated collision, and the hashes would still collide. It doesn't matter what the text before the discovered collision block is. It could be anything (plus padding to make it to a multiple of the block length.)

This makes the break a much more serious problem than simply finding two completely random messages that happen to have the same hash. It's only a guess at the moment, but I assume the SHA-1 attack will work the same way. The brief findings mentioned using the same sort of attack, hopefully the results will be similar.

(Side note 1: The term used by every cryptographer i've ever encountered is "break". Feel free to use what you want, but don't claim that "break" is for some reason incorrect. If you want to argue about it, see my prior post on "Stealing" vs. "Copyright Infringement.")

(Side note 2: Even if one was going to brute force SHA-1, you would still get the same failure mode as described. When trying all the possible hashes, you would simply use the output of SHA1 of the nefarious file as the IV in the brute-force attack. Iterated hashes, in my very uneducated opinion, are on their way out. What they will be replaced with, however, I have no idea. )
Re:Come on... by uhoreg · 2005-02-20 11:26 · Score: 2, Insightful

What you are describing is a different type of attack from what the Chinese researchers discovered. Their attack allows them to generate two messages that have the same hash; it doesn't allow them to generate a message that hashes to a fixed value. So password hashing is still safe -- AFAIK, there are no known attacks against it other than brute force (or rubber hose).

--
To get something done, a committee should consist of no more than three persons, two of them absent.
Re:Come on... by Aeiri · 2005-02-20 11:29 · Score: 2, Funny

If someone uses funding of $25-38M to break an algorithm of mine, then I want them to be able to break it. It'll make me feel good that someone wants my information that badly, especially when it's stuff like "hmm I need to get eggs tonight after work".
Re:Come on... by uhoreg · 2005-02-20 11:32 · Score: 3, Informative

All hash algorithms are vulnerable to this if you don't use a salt (or too small of a salt). UNIX-like OSes have been using salt for a very long time (if not forever). See, for example, the crypt(3) man page. If you use a large enough salt, precomputed hash databases are pretty much useless.

--
To get something done, a committee should consist of no more than three persons, two of them absent.
Re:Come on... by jallen02 · 2005-02-20 11:52 · Score: 2, Informative

According to Bruce Schneier a machine can be built that can do it in 56 hours.

Jeremy
Re:Come on... by kiltedtaco · 2005-02-20 12:28 · Score: 2, Informative

I re-read the paper, and realize there is more than one way to interpret a part of it. I'm looking, but until then don't trust what I just posted. I may be forced to mod myself -5 misread the fine paper.

the problem is still there by bird603568 · 2005-02-20 09:04 · Score: 3, Insightful

wouldn't the problem still exist but the odds of cracking it would be so huge it wouldn't be worth it?
right? correct me if im wrong.

Re:the problem is still there by pclminion · 2005-02-20 09:22 · Score: 3, Insightful

Well, until mankind figures out a way around the pigeonhole problem -- which is NEVER -- this "problem" will always exist.
What we should be asking ourselves is, is there a way to construct a hashing algorithm for which the OPTIMAL method for finding collisions is a brute force search? So far it hasn't been done, and it hasn't been definitely proven to be possible or impossible, either.
I see a lot of people on these forums complaining that we should "just" make a hash algorithm that is unbreakable. It's a logical impossibility. Can you fit an infinite number of things into a finite number of holes and guarantee that each hole has at most one object in it? I hope people are capable of grasping that, at least.
Re:the problem is still there by Ziviyr · 2005-02-20 09:35 · Score: 2, Funny

If you were able to backconvert to password + salt from hash, that would be minusminusgood.

According to my newspeak dictionary, that'd be double-plus-ungood.

--

Someone set us up the bomb, so shine we are!
Re:the problem is still there by kiltedtaco · 2005-02-20 10:19 · Score: 2, Funny

HAH. That's the first times i've ever seen someone get their newspeak grammar corrected. I like it.
Re:the problem is still there by Llywelyn · 2005-02-20 12:41 · Score: 2, Insightful

Slight clarification.

It is a logical impossibility to make one that dodges the pigeonhole principle, i.e., one that is "collisionless."

This is different from whether one can be "broken," i.e., a message can be found that collides in less than brute force time (2^80 for SHA1).

--
Integrate Keynote and LaTeX

Why not move sooner? by }InFuZeD{ · 2005-02-20 09:04 · Score: 4, Insightful

Is there a reason to wait until someone breaks the existing algorithm before moving to a stronger one?

It seems to me that if you start working on implementing the stronger ones BEFORE your existing one is broken?

An ounce of prevention...

Re:Why not move sooner? by Anonymous Coward · 2005-02-20 09:41 · Score: 3, Informative

Is there a reason to wait until someone breaks the existing algorithm before moving to a stronger one?
It seems to me that if you start working on implementing the stronger ones BEFORE your existing one is broken?

Because of the chance that someone might find a weakness in the supposedly stronger one before a weakness is found in the supposedly weaker one.

Since you don't know which algorithm is going to be broken first, you pick one based on other advantages, like wider availability and more efficient calculation.

And, BTW, SHA-1 is not cracked wide open yet; it just looks worryingly like a usable flaw will be found in the very near future. Therefore, people are moving away from it. An ounce of prevention... exactly like you said.

i'm no crypto expert... by Phil246 · 2005-02-20 09:05 · Score: 2, Insightful

but why not take a hash of a hash ?
if its broken once - all you get is another hash and with no way of telling if you`ve cracked it or not, its useless

Re:i'm no crypto expert... by Shazow · 2005-02-20 09:11 · Score: 3, Informative

Technically, that would simply double the number of operations required to perform the decryption, which does not effectively raise its complexity..

ie. say it takes n time to crack a hash, then cracking a hash of a hash would take 2n...
O(2n) is still O(n)

Of course that's assuming they aren't doing it by "eye" and they have some sort of solid algorithm to do it.

- shazow
Re:i'm no crypto expert... by Sweetshark · 2005-02-20 09:43 · Score: 4, Insightful

but why not take a hash of a hash ?
Because breaking the hash means finding two documents resulting in the same hash. If the first hash ist the same for both documents all hashes of hashes will be the same too.
What you could do is using different hash-algos, but it increases the amount of code to be managed and reviewed thoroughly (security by obscurity rarely works). And it increases the size of the digest - SHA-256 does that too but it keeps the algorithm simple.

Bah. by koreaman · 2005-02-20 09:07 · Score: 3, Funny

Who needs fancy things like PGP? I encrypt all my sensitive data in ROT-13, and it hasn't been cracked yet!

--
Le français vous intéresse?

Re:Bah. by WombatDeath · 2005-02-20 09:11 · Score: 4, Funny

Same here, though I apply it twice for additional security. Can't be too careful...
Re:Bah. by God!+Awful+2 · 2005-02-20 09:27 · Score: 4, Funny

Who needs fancy things like PGP? I encrypt all my sensitive data in ROT-13, and it hasn't been cracked yet!

Are ROT-13 jokes still +1 funny?

I thought we had moved past ROT-13 and ROT-26 and you had to posit ROT-39 or up in order to get a rise out of people.

-a

--
/. users can't
Re:Bah. by Wordsmith · 2005-02-20 09:44 · Score: 3, Funny

Actually, Rot-13 jokes are still +14 funny.
Re:Bah. by TheRaven64 · 2005-02-20 09:50 · Score: 2, Funny

I'm sorry, but encrypting your post with ROT-52 didn't make it any more funny.

--
I am TheRaven on Soylent News

Have to buy it again? by ehiris · 2005-02-20 09:09 · Score: 2, Interesting

Would current customers have to buy PGP again? I see the problem as a bug not an "old version" weakness.

I don't think they've officially decided to change by papercut2a · 2005-02-20 09:16 · Score: 4, Informative

There's a discussion about this very subject going on on the IMC's discussion list for OpenPGP. From reading the posts, particularly the ones by PGP's Jon Callas, I don't think that PGP has officially decided to implement this change just yet. (On the list, the thread titled "SHA-1 broken" is the one you will want to follow.)

But then, I could have missed something.

SHA-1 break illustrated.. by __aaijsn7246 · 2005-02-20 09:17 · Score: 5, Interesting

http://lists.gnupg.org/pipermail/gnupg-users/2005- February/024862.html

Atom Smasher atom at smasher.org
Wed Feb 16 21:56:25 CET 2005

Hash: SHA256

this should help put the (alleged until proven otherwise) SHA-1 break into
perspective. thanks to Sascha Kiefer for giving me the idea.

let's say that unbroken SHA-1 represents a 100 meter (328 ft) wall. if a
break allows a collision to be found in merely 2^69 operations (on
average), that would mean the wall has crumbled to 4.9 cm (1.9 in) tall.
that's broken!!

OTOH, let's say that unbroken MD5 represents a 100 meter (328 ft) wall.
comparing unbroken MD5 to broken SHA-1 means the wall would actually grow
from 100 meters (328 ft) tall to 3.2 km (1.99 miles) tall. SHA-1, even if
it's broken enough to find a collision in 2^69 operations (on average), is
still stronger than MD5 was ever meant to be.

again, using unbroken MD5 as our reference of a 100 meter (328 ft) wall,
unbroken SHA-1 would be a wall 6553.6 km (4072 miles) tall. SHA-1 was
intended to be incredibly stronger than MD5.

- -- ...atom

Re:What about GPG? by papercut2a · 2005-02-20 09:18 · Score: 5, Informative

IIRC, GPG already allows SHA-256 and SHA-512, but doesn't default to them.

Re:I'm all for encyrption by Storlek · 2005-02-20 09:21 · Score: 2, Insightful

(PHPBBQ? *mentally runs sed s/PHP/PGP/g on post*)

I would still rather see people encrypt all their data than to send (even potentially) sensitive data in plain text. Sure, the best option would be educating people on what is really important, and thus worth encrypting, but a lot of people can't seem to grasp the concept of privacy/security. I know people who would submit a credit card number to some shady website over plain HTTP, without even looking on the page for a privacy policy.

Granted, it is borderline ridiculous to encrypt anything and everything, but it's better than not encrypting anything at all and hoping nobody's looking.

--
Bears don't normally eat things that talk and move backwards.

Re:What about GPG? by papercut2a · 2005-02-20 09:49 · Score: 5, Informative

Just to confirm, GPG 1.4 DOES support the more-bits versions of SHA. Run GPG with the --version parameter to get something like this for your copy:

Supported algorithms: Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA Cipher: 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512

Phones tapped? by theLOUDroom · 2005-02-20 10:05 · Score: 3, Insightful

So what do you guys wanna bet that at least a few of these researchers have their phones tapped at this point?

I can't think of any intelligence agency that that wouldn't like a few days head start with any more findings these guys come up with.

I'm not really headed anywhere specfic with this comment, other than getting this thought out there. People have been bugged to gain access to much less exciting information than this.

--
Life is too short to proofread.

Missing details to complete the perspective by mukund · 2005-02-20 10:12 · Score: 4, Insightful

Adding to what you've said, if the cumbled SHA-1 wall is 4.9 cm (1.9 in) tall, our current average reach of scaling the wall is still a few nano metres.

It appears as if that 4.9 cm wall is very scalable, but it still isn't easily scalable.

Quoting Bruce Schneier's quote of what Jon Callas, PGP's CTO said: "It's time to walk, but not run, to the fire exits. You don't see smoke, but the fire alarms have gone off."

--
Banu

Re:Collisions by theLOUDroom · 2005-02-20 11:34 · Score: 2, Insightful

Why not use two hashes? It's exponentially harder to find a collision that fits for two hashes, isn't it?

Two reasons:

The first is implementation specfic. Say you're using this hash function for a typical /etc/passwd file. By using two hashes you've just made yourself even weaker than if you had only used one hash. (It's like having two doors with one lock each, not two locks on one door.)
Note that there are circumstances where you don't care about this, because the original data is public and you just want to be sure it wasn't fiddled with.
The second lies in that fact that yes, you are making it hard to tamper with a file by using two algorithms, but unless you have two algorithms that are exactly equally secure, you would be better off just applying those extra bits to make the hash from the stronger algorithm longer.

--
Life is too short to proofread.

Found 2ROT-13 insecure, use 3ROT-13 instead by fleppir · 2005-02-20 11:47 · Score: 2, Funny

had to be said ......

--
I am the Barber of Seville.

Re:This reminds me... by Lord+Ender · 2005-02-20 11:53 · Score: 2, Informative

Moderators: please realize this guy is talking completely out of his ass. It is clear he has never studied cryptology, even just a little. Please make sure nobody reads this comment, because everyone who does will be made dumber as a result.

--
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.

Re:This reminds me... by DeadMeat+(TM) · 2005-02-20 12:31 · Score: 2, Informative

the PS3 runs Linux

No, it doesn't.

can be programmed just like a regular computer

No, it can't.

64bit computers [...] can move the data around a lot faster

No, they can't.

GnuPG has this already by Gemini · 2005-02-20 13:44 · Score: 3, Interesting

To forestall the obvious question about GnuPG compatibility, GnuPG has had SHA-256, SHA-384, and SHA-512 since version 1.2.2 (2003-05-01) so it will interoperate nicely with the new PGP.

Incidentally, despite what the article implies, PGP has actually had SHA-256 support for a while now. It's not exposed in the GUI, but if you use GnuPG to generate a SHA-256 message, PGP can handle it.

In terms of what the SHA-1 "break" means, it is certainly time to start migrating to something stronger, but it is not time to panic and start revoking keys. Think of this as the MD5 situation in the late 1990s: a flaw was found, people migrated away, and when the serious MD5 crack was found last year, most people had already stopped using it.

The sky isn't falling. It's just a wake up call to start moving to something better.

Clearing up some misconceptions by cpeikert · 2005-02-20 16:19 · Score: 2, Informative

Some comments (that I have not seen emphasized much) about all this SHA-1 stuff:

The fact that there is a 2^{69}-time attack (versus a 2^{80} naive attack) on SHA-1 may only be the tip of the iceberg. Once the methods of attack are published and studied widely, other more efficient attacks may be found (historically, this is more likely than not). Saying "we're still safe; the attack is too slow and doesn't find a second preimage" is very naive.
Hash algorithms like SHA-1 are used for more than just digital signatures. They are often used to achieve certain strong properties (like chosen-ciphertext security) in some public-key encryption algorithms (like OAEP). So saying "this only affects signatures" is wrong -- we don't yet know what effect these attacks might have on the security of the many other cryptographic schemes and protocols that use hashing primitives.

Re:This reminds me... by Audacious · 2005-02-20 18:25 · Score: 2, Informative

Ok, I realize this is just flamebait but I have to say that this is just untrue. First you know absolutely nothing about me or my background. Second my statements are true.

Let's look at the second one first:

1. No matter how brainy you are, it requires a computer (now-a-days) to break any kind of cryptology which is in place.

2. No matter how smart you may be, you won't be able to test your premise without the usage of a computer. Further, it is not so much hard core number crunching (as in testing each and every possible combination which would take millions or billions of years to do) as it is coming up with an algorithm which will work.

3. In the case of DRM, we are using and following rules which we have devised to tell us how we can make use of Quantum particles to generate random numbers. As such, it is not impossible for someone to accidentally stumble upon or even develop on purpose an algorithm which will undo what was done. It is just a matter of when this will happen.

Now let's look at the first one:

1. I have never said I was a genius or even brilliant at cryptography.

2. But I have studied the field since I have worked with DoD before in various ways.

3. I have also let it be known that I do work at NASA without any degree at all. However, NASA does consider me to have several masters. Both in mathematics as well as computer science.

Finally, you are entitled to your opinion and I probably could do with some more reading in the area of cryptology. Unfortunately, presently I'm helping NASA rebuild their CAD system of information about the Space Shuttle and do not have the time. Maybe later.

Enjoy life.

--
Someone put a black hole in my pocket and now I'm broke. :-)

Re:I'm all for encyrption by ArbitraryConstant · 2005-02-21 07:55 · Score: 2, Insightful

"Since then, the USA's encyrption policy has been undermined from so-called allies such as Canada and Mexico such that these technologies are in the public domain and commonly used in communicating things that threaten our national security."

The US's encryption policy has been undermined because it's stupid. Canada and Mexico are only two of the dozens of countries that agree with my assessment.

Even if the USA were the only source of strong crypto (Not the case. Rijndael aka AES comes from Belgium.) or every other country agreed with the American position (ha!), it only takes one leak for the bad guys to get the good cyphers.

One leak. When every computer has a binary implementation that can be reverse engineered. When open source software has the source code available for all to see. Even if nobody sold/distributed the good versions outside of the US, it would still be trivial to get a good version out.

--
I rarely criticize things I don't care about.

Slashdot Mirror

PGP Moving To Stronger SHA Algorithms

68 of 247 comments (clear)