4 ms·
Just to clarify, this makes a collision attack feasible, not a preimage attack. That means (iirc) someone can create two messages that have the same hash - but
by smanek 17y ago
Just to clarify, this makes a collision attack feasible, not a preimage attack.
That means (iirc) someone can create two messages that have the same hash - but not create a message that has a particular hash.
Still not ideal - but not terrible. It still wouldn't be feasible, for example, to bruteforce a password from its hash.
- tc 17y agoYou can still inflict a lot of damage if you can create collisions. Producing a rogue CA is just one possibility. http://www.phreedom.org/research/rogue-ca/ http://www.phreedom.org/research/rogue-ca/ The potential for intentional collisions makes it critical that an attacker cannot control or predict all of the inputs to your signing operation.