3

I am trying to figure out the scope of SHA1 deprecation for existent signatures. Reading this.An attacker (after 110 years) could present a fake document for a valid signature

I believe this only affect to integrity between signature and document and not to signatory identity (except if a SHA1 certificate is used?)

I think adding a timestamp on the signature, even with SHA512, does not avoid the problem. It is needed to re-hash the document and apply a timestamp on signature+new hash

Is that so?

2

Collisions do not threaten existing signatures. A collision means the attacker has the ability to create/modify both of the inputs to create colliding hashes. The attacker obviously can't create or modify an existing document, so instead he or she must find a second pre-image, which is creating a single new input that has the same hash as the first input. No researcher has made significant progress in breaking even reasonably old hashes like MD5 in this manner.

  • Current Collision attacks on SHA-1 rely on modifying both of the documents to create a collision. As computing power increases, it will become possible to create a collision to an existing document. Since the OP asks about 110 years in the future, the likelihood of this compute power existing is very large, thus, collisions threaten existing signatures. – MikeP Mar 13 '17 at 23:58
  • @MikeP Collision attacks, as defined in cryptography, don't ever effect existing signatures. Second pre-image attacks do. And the current attack takes 110 GPU years, not calendar years. – Xander Mar 14 '17 at 0:50
  • my understanding is that second preimage is a subset of collision. – MikeP Mar 27 '17 at 16:01
1

Current Collision attacks on SHA-1 rely on modifying both of the documents to create a collision. As computing power increases, it will become possible to create a collision to an existing document. Since the OP asks about 110 years in the future, the likelihood of this compute power existing is very large, thus, collisions threaten existing signatures.

Sha2-512 is MUCH, MUCH stronger than SHA-1. (512 bits vs 160 bits). And, since that is 2^512 and 2^160, 512 is 9x10^105x stronger than Sha-1 (in bits).

And, note, there have been attacks on MD2...

ALL Cryptography CAN be broken, and WILL be broken given enough time and resources. For example, the Enigma machine from WWII was partially "broken" back then due to repetition, and today would likely be a cinch for a modern machine to break. DES is 56-bit encryption and is considered "broken" for sensitive data.

  • 1
    Well, 110 years was the value stated in Google's article to create a collision with the current power. My signatures have a life of 5 years. I suppose I can be relatively calm for now, but I must perform a rehash in the future and change my signature software (it is complex ...) to use SHA2 – pedrofb Mar 10 '17 at 7:50
  • That is current, and likely based on some arbitrary amount of compute power. Harness the power of the NSA or a bot-net, and someone can get several magnitudes faster, and then there are increases in hardware. So, 110 years is likely to be closer to 2-5. Quantum computers might change this all as well. – MikeP Mar 13 '17 at 23:57
  • "ALL Cryptography CAN be broken, and WILL be broken given enough time and resources." This is demonstrably false. Information theoretically secure systems survive even a computationally unbouned attacker. Even non-information theoretically secure systems can be demonstrated to require more energy than exists in the universe in order to attack. – Xander Mar 14 '17 at 0:37
  • The bits of output do not determine the strength of the hash function. Ideally, the security provided by SHA-1 and SHA-512 are half the length of the output...2^80 and 2^256 respectively. However, attacks on either at that cost are futile. Weaknesses in the algorithms must be found. The current attacks on SHA-1, for instance, has a cost of roughly 2^63. Simply comparing the output length tells you little to nothing about overall security. – Xander Mar 14 '17 at 0:44
  • The attack takes 110 GPU years, not 110 calendar years. – Xander Mar 14 '17 at 0:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.