Re: draft-klensin-emailaddr-i18n-00

Adam M. Costello scripsit:

> Besides, even if you could find two canonically equivalent messages
> (that is, two messages that become equal when normalized) with the same
> hash value, how could you base an attack on that?  You could substitute
> one message for the other without being detected, but if they mean the
> same thing, what harm is done?  For an effective attack, wouldn't you
> want two truly different messages with the same hash value?

Yes.  The method of the birthday attack is that you generate 2^(n/2) variants
of the message you wish to forge, and 2^(n/2) variants of an innocuous message.
By the birthday paradox, some pair will match hash values.  You then convince
Alice to sign the chosen variant of the innocuous message (perhaps a 
petition for some cause), copy the signature to the corresponding variant of
the message to be forged, and forward it to Bob.

> SHA-1 has 160 bits.  The computing resources to compute 2^80 hashes
> won't exist for another 30 years or so, assuming Moore's law continues
> that long.  By that time people will have hopefully stopped accepting
> signatures based on 160-bit hashes and demand longer ones.  

However, old contracts will still exist and their authenticity may need to be
verified.

-- 
John Cowan  [email protected]  www.ccil.org/~cowan  www.reutershealth.com
"The competent programmer is fully aware of the strictly limited size of his own
skull; therefore he approaches the programming task in full humility, and among
other things he avoids clever tricks like the plague."  --Edsger Dijkstra