Re: Adding a nounce before hashing as covert channel (Re: phasing out SHA1 for digest creation)

Andrew Gallagher via Gnupg-devel <[email protected]> Tue, 10 Dec 2024 16:06:41 +0000

Newsgroups	gmane.comp.encryption.gpg.devel
Message-ID	<[email protected]>

On 10 Dec 2024, at 08:48, Bernhard Reiter via Gnupg-devel <[email protected]> wrote:
> 
> Am Samstag 07 Dezember 2024 15:35:09 schrieb Andrew Gallagher via Gnupg-devel:
>> there are already countless places in the wire format that an adversary
>> could use for a covert channel,
> 
> It still may not be wise to add another place.
> There can be unwanted side effects of adding a nonce
> (is what I understand from the example).

There might be, however since the nonce is signed over as if it were the first N bits of the document, manipulating the nonce of a salted signature would be equivalent to manipulating the first N bits of a document signed by an unsalted signature. Collision attacks generally require manipulation of many more bits than is provided by a V6 signature salt, which is half the bit length of the digest algorithm. And remember that the nonce is not attacker-controlled, unlike the document. Even if there were an additional vulnerability introduced, the attacker would have a 1 in O(2^N) chance of successfully exploiting it.

> Not saying that this is done deliberately.

Of course you aren't. I do wish we could have a reasonable discussion without other people resorting to veiled allegations and FUD.

A

_______________________________________________
Gnupg-devel mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-devel

signature.asc (application/pgp-signature, 833 B)