3 ms·
We actually find some PDF signature collisions in the wild in Polar (https://getpolarized.io/ https://getpolarized.io/). One user found that a few of the docum
by burtonator 8y ago
We actually find some PDF signature collisions in the wild in Polar (https://getpolarized.io/ https://getpolarized.io/).
One user found that a few of the documents he added conflicted with the signature of other PDFs.
I knew that the PDF signature wasn't strong but didn't think we would actually have real world conflicts.
We're already moving to SHA256 of the raw binary data instead of the fingerprint for newer documents added to your repository.
We're going to use the actual strong hashcode to enable "distributed" annotations so that two people annotating the same document can easily discover each other and share comments, highlights, flashcards, etc.
I'm pretty damn excited about this feature actually.
- tialaramex 8y agoYour link doesn't seem to have any such "PDF signature collisions", it's just a link to some product you're presumably hawking. The article ("How to Spoof PDF Signatures") doesn't find any collisions or similar cryptographic weakness. Instead, as you'd expect, what they found was that software doesn't actually implement the cryptography very well. So what is in principle a perfectly good secure signature system can be "spoofed". If you use fixed software, the problem goes away.