Re: draft-klensin-emailaddr-i18n-00

John Cowan <[email protected]> wrote:

> The method of the birthday attack is that you generate 2^(n/2)
> variants of the message you wish to forge, and 2^(n/2) variants of an
> innocuous message.  By the birthday paradox, some pair will match hash
> values.

Ah, thanks.  Still, I think the secure defense against that attack is to
use a hash function with a great enough n to make the attack infeasible,
not to rely on the message format to prevent variants.

> > The computing resources to compute 2^80 hashes won't exist for
> > another 30 years or so, assuming Moore's law continues that long.
> > By that time people will have hopefully stopped accepting signatures
> > based on 160-bit hashes and demand longer ones.
>
> However, old contracts will still exist and their authenticity may
> need to be verified.

Good point.  If I had a contract with a signature that looked like it
might become forgeable before the contract expired, I'd ask the signer
to re-sign it with a stronger signature.  If they refused, I'd sue them
soon, before new technology appeared that would allow them to plausibly
claim that the old signature was forged.

AMC