aef

less info
meta site favicon meta user | stack exchange network profile network profile
138 reputation
5
bio website aef.name
location Germany
age 26
visits member for 1 year, 2 months
seen Nov 10 '12 at 14:29
stats profile views 12

2 Comments

suggestions reviews revisions comments badges posts accepts all
Nov
10
 comment Replacing weak SSH fingerprint algorithms
From what Wikipedia says about the second preimage attack, I can only guess why this is not applicable here. An attacker not only has the hash, but can easily get the public key (message) of the server he wishes to immitate. That's exactly the same as in the rogue CA attack. I guess what could be the difference is that a plain public key has no comment field like X.509 certificates which you can bloat with random noise until the hash matches. Is that what you mean to be the difference?
Nov
10
 comment Replacing weak SSH fingerprint algorithms
Maybe I have a misconception about this, but how is using MD5 as a fingerprint for manual user matching less attackable by collision attacks than the following: phreedom.org/research/rogue-ca ?