11 ms·

I suppose I'm also wondering if there's an authentication protocol where the challenger actually tells the prover what hash it has to match. Does a challenger e

by schoen 10y ago

I suppose I'm also wondering if there's an authentication protocol where the challenger actually tells the prover what hash it has to match. Does a challenger ever effectively say "Please tell me the secret whose SHA256 is equal to fcdf324499312efa027b5033513b0c0968f74ae7ba81a271ae62b3dda2cd4143 in order to proceed"? Maybe protocols where the attacker has access to a signature over some data, but doesn't get access to the signed data in plaintext? Then the attacker could try to brute-force values of the signed data using the hash that forms the basis of the signature?

dsl 10y ago
Think about any software updates you do (Windows Update, apt, yum, etc). All these systems rely on distributing a cryptographic ally signed manifest of what each files hash should be. If you can forge the hash of a file, or the signature on that manifest, there are hundreds of different ways you can easily replace one file for another in transit over the internet.
- ethbro 10y ago
  I'd guess something like Quantum Insert + targeting unprotected connections. Which I'd imagine there are still a lot of out there (circa pre-2000). I'd be curious if there's any older network gear that provides a hash-based rather than connection-based security model. It seems like the thing that might have seemed like a good idea to a military 40 years ago.
- tptacek 10y ago
  We're also not a supercomputer advance away from breaking SHA2. There are hash-designing cryptographers who believe we may never break SHA2 with conventional computers.
- schoen 10y ago
  That's a very different attack than I was looking for; you've described a second preimage attack, which would be considered a fundamental weakness of the hash. I was looking for a protocol where a comparatively small amount of signed data (let's say less than 90 bits) is kept secret, but can potentially be brute-forced on an appropriate supercomputer.
tptacek 10y ago
I think you're describing most KDF attacks, of which password hashes are particular (and easy) example. I can't think of an instance of this attack that isn't password hashes that is so widely deployed that it would be economical to invest in 9-figure supercomputers to attack it, but that obviously doesn't mean one doesn't exist.

by schoen 10y ago

dsl 10y ago

Think about any software updates you do (Windows Update, apt, yum, etc). All these systems rely on distributing a cryptographic ally signed manifest of what each files hash should be. If you can forge the hash of a file, or the signature on that manifest, there are hundreds of different ways you can easily replace one file for another in transit over the internet.

ethbro 10y ago
I'd guess something like Quantum Insert + targeting unprotected connections. Which I'd imagine there are still a lot of out there (circa pre-2000). I'd be curious if there's any older network gear that provides a hash-based rather than connection-based security model. It seems like the thing that might have seemed like a good idea to a military 40 years ago.
tptacek 10y ago
We're also not a supercomputer advance away from breaking SHA2. There are hash-designing cryptographers who believe we may never break SHA2 with conventional computers.
schoen 10y ago
That's a very different attack than I was looking for; you've described a second preimage attack, which would be considered a fundamental weakness of the hash. I was looking for a protocol where a comparatively small amount of signed data (let's say less than 90 bits) is kept secret, but can potentially be brute-forced on an appropriate supercomputer.

tptacek 10y ago

I think you're describing most KDF attacks, of which password hashes are particular (and easy) example. I can't think of an instance of this attack that isn't password hashes that is so widely deployed that it would be economical to invest in 9-figure supercomputers to attack it, but that obviously doesn't mean one doesn't exist.