Re: Back to Merkle Hash Trees...

On 7/02/2005, at 10:43 AM, Joseph Ashwood wrote:
>> Why not?
>> If I have file A, calculate the merkle tree and root hash rh(A), give
>> you rh(A), how can you give me file B with rh(B) = rh(A)?
>
> Depends on the hash used. If you use SHA-0 yes, if you use MD5 yes, 
> SHA-1 is
> the next in that series and is getting close, SHA-256/384/512 already 
> have
> weaknesses in this area shown against them.
>
> Actually in an effort to get this as good as possible I have to admit 
> that
> my proposal is not optimally secure either. While it does not suffer 
> from
> the preimage order attack of the original it does suffer from a first
> preimage attack, to correct this is fairly easy change my proposal 
> from:

As far as I'm aware, there have been no preimage attacks found in MD5, 
SHA-0, or SHA-1. See http://www.cryptography.com/cnews/hash.html.
Trying to build a merkle tree implementation assuming fundamental 
weaknesses in the hash you're using seems a bad idea. If the hash is 
broken, all bets are off.

-Nick Johnson



 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/BitTorrent/

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/