Home page logo

bugtraq logo Bugtraq mailing list archives

Re: MD5 To Be Considered Harmful Someday
From: Steve Friedl <steve () unixwiz net>
Date: Wed, 8 Dec 2004 11:22:57 -0800

On Tue, Dec 07, 2004 at 06:51:48PM -0700, Joel Maslak wrote:
That can be a problem.  It breaks non-repudiation - someone could create
such a "swappable" contract and go to court and say "Yes, that's a valid
signature, but I really signed *THIS* document which just happens to have
an identical signature."  Of course if I was called upon to testify, I
would respond, "Yes, but it is clear this contract was written with the
intent to defraud us, as to get this property, it has to be constructed in
a very specific mind with this fraud in mind at time of contract

Bruce Schneier has long suggested that when signing a document made by
others, make some cosmetic changes to break any precomputed hash that
the creator might have in store for you.

Also: those who are not fully up to speed on the details of crypto hashes
might find my Tech Tip helpful:

        An Illustrated Guide to Cryptographic Hashes


Stephen J Friedl | Security Consultant |  UNIX Wizard  |   +1 714 544-6561
www.unixwiz.net  | Tustin, Calif. USA  | Microsoft MVP | steve () unixwiz net

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]