meta user
network profile
|
Nov 10 |
comment |
Replacing weak SSH fingerprint algorithms From what Wikipedia says about the second preimage attack, I can only guess why this is not applicable here. An attacker not only has the hash, but can easily get the public key (message) of the server he wishes to immitate. That's exactly the same as in the rogue CA attack. I guess what could be the difference is that a plain public key has no comment field like X.509 certificates which you can bloat with random noise until the hash matches. Is that what you mean to be the difference? |
|
Nov 10 |
revised |
Replacing weak SSH fingerprint algorithms added 128 characters in body |
|
Nov 10 |
awarded | Custodian |
|
Nov 10 |
reviewed | Approve suggested edit on Replacing weak SSH fingerprint algorithms |
|
Nov 10 |
comment |
Replacing weak SSH fingerprint algorithms Maybe I have a misconception about this, but how is using MD5 as a fingerprint for manual user matching less attackable by collision attacks than the following: phreedom.org/research/rogue-ca ? |
|
Nov 10 |
asked | Replacing weak SSH fingerprint algorithms |
|
Feb 27 |
awarded | Scholar |
|
Feb 27 |
accepted | Could the bcrypt-ruby binding be vulnerable? |
|
Feb 24 |
revised |
Could the bcrypt-ruby binding be vulnerable? deleted 10 characters in body |
|
Feb 24 |
awarded | Editor |
|
Feb 24 |
revised |
Could the bcrypt-ruby binding be vulnerable? added 244 characters in body |
|
Feb 24 |
awarded | Supporter |
|
Feb 24 |
awarded | Student |
|
Feb 24 |
asked | Could the bcrypt-ruby binding be vulnerable? |
