Bugtraq mailing list archives
Re: MD5 To Be Considered Harmful Someday
From: Steve Friedl <steve () unixwiz net>
Date: Wed, 8 Dec 2004 11:22:57 -0800
On Tue, Dec 07, 2004 at 06:51:48PM -0700, Joel Maslak wrote:
That can be a problem. It breaks non-repudiation - someone could create such a "swappable" contract and go to court and say "Yes, that's a valid signature, but I really signed *THIS* document which just happens to have an identical signature." Of course if I was called upon to testify, I would respond, "Yes, but it is clear this contract was written with the intent to defraud us, as to get this property, it has to be constructed in a very specific mind with this fraud in mind at time of contract origination..."
Bruce Schneier has long suggested that when signing a document made by others, make some cosmetic changes to break any precomputed hash that the creator might have in store for you. Also: those who are not fully up to speed on the details of crypto hashes might find my Tech Tip helpful: An Illustrated Guide to Cryptographic Hashes http://www.unixwiz.net/techtips/iguide-crypto-hashes.html Steve -- Stephen J Friedl | Security Consultant | UNIX Wizard | +1 714 544-6561 www.unixwiz.net | Tustin, Calif. USA | Microsoft MVP | steve () unixwiz net
Current thread:
- MD5 To Be Considered Harmful Someday Dan Kaminsky (Dec 07)
- Re: MD5 To Be Considered Harmful Someday Gandalf The White (Dec 07)
- Re: MD5 To Be Considered Harmful Someday Tim (Dec 08)
- Re: MD5 To Be Considered Harmful Someday Dragos Ruiu (Dec 08)
- Re: MD5 To Be Considered Harmful Someday David F. Skoll (Dec 08)
- Re: MD5 To Be Considered Harmful Someday Joel Maslak (Dec 08)
- Re: MD5 To Be Considered Harmful Someday Steve Friedl (Dec 08)
- RE: MD5 To Be Considered Harmful Someday David Schwartz (Dec 08)
- Re: MD5 To Be Considered Harmful Someday Gandalf The White (Dec 08)
- Re: MD5 To Be Considered Harmful Someday Keith Oxenrider (Dec 08)
- Re: MD5 To Be Considered Harmful Someday Paul Wouters (Dec 08)
- Re: MD5 To Be Considered Harmful Someday Dan Kaminsky (Dec 08)
- Re: MD5 To Be Considered Harmful Someday Paul Wouters (Dec 08)
- Re: MD5 To Be Considered Harmful Someday Adam Shostack (Dec 09)
- Re: MD5 To Be Considered Harmful Someday Tim (Dec 08)
- Re: MD5 To Be Considered Harmful Someday Solar Designer (Dec 08)
- Re: MD5 To Be Considered Harmful Someday Dan Kaminsky (Dec 08)
- Re: MD5 To Be Considered Harmful Someday Pavel Kankovsky (Dec 09)
- Re: MD5 To Be Considered Harmful Someday Gandalf The White (Dec 07)