Re: draft-klensin-emailaddr-i18n-00

John Cowan <[email protected]> wrote:

> > The receiver will be fooled only if it blindly assumes that the text
> > is normalized.  They can't be fooled if they force the text to be
> > normalized whenever it matters.
>
> Oh yes they can, and all the worse.  Consider the classical birthday
> attack: see http://www.x5.net/faqs/crypto/q96.html for details if you
> need them.  It depends on the ability to generate 2^(n/2) variants
> (where n is the number of bits in the n-bit signature hash function)
> of a message to be used for the spoof.
>
> If we play with Unicode canonical equivalence in a world where
> receivers normalize, however, we can create variants that are quite
> undetectable by the receiver.

A crytographic hash is considered secure if it is infeasible to
reconstruct any part of the message given its hash value and it is
infeasible to find any two messages with the same hash value.  That's
*any* two messages, not just two messages that are somehow equivalent.
If the attacker cannot find any two messages with the same hash value,
then he cannot find two equivalent messages with the same hash value
either.

Besides, even if you could find two canonically equivalent messages
(that is, two messages that become equal when normalized) with the same
hash value, how could you base an attack on that?  You could substitute
one message for the other without being detected, but if they mean the
same thing, what harm is done?  For an effective attack, wouldn't you
want two truly different messages with the same hash value?

> Typical German text contains about 5% accented characters, so a 20K
> message can be given 2^1000 variants, more than enough to break
> reasonable hash functions.

Just because 2^1000 variants exist doesn't mean you can enumerate them
and compute the hash value of each one.  I think there are proofs that
doing so would require more energy than is thought to exist in the
universe,

SHA-1 has 160 bits.  The computing resources to compute 2^80 hashes
won't exist for another 30 years or so, assuming Moore's law continues
that long.  By that time people will have hopefully stopped accepting
signatures based on 160-bit hashes and demand longer ones.  256-bit and
512-bit versions of SHA have already been defined.

AMC