There was this question in last year's exam. The teacher claims that answer b) (in boldface below) is correct.

Attacks are constantly being performed on digital signatures which use weak hash functions (e.g. MD5).

When an exploit of a hash algorithm is found,...:

a) all the signed documents are equally exposed.

b) the newly signed documents are more exposed.

c) the older documents are more exposed.

d) the older documents are a little more exposed.

Upon reading the question I first would have went with answer a), since I don't know what time has to do with a vulnerability in a hash function. But then I thought maybe it has something to do with the expiration date of the involved certificates (and public keys).

Is this why b) is, supposedly, the correct answer? If not, then why would b) be correct?

The question was asked strictly in terms of the cryptography involved.

  • Was the question in a context of just the cryptography, or was it in the context of the entire system including the human users? Maybe it's (b) not because of cryptography, but because faking newer documents might prove more fruitful to an attacker? – a CVn Jan 31 '15 at 17:49
  • 1
    @MichaelKjörling: Only cryptography. – RunoTheDog Jan 31 '15 at 17:54

B) is in fact the correct answer, at least for the kinds of attack found against MD5 and SHA1. Those hashes are vulnerable to a collision attack, which means an attacker can reasonably find two things that hash to the same value. If he gets the victim to sign one, he can then just use that same signature on the other. However, he can't necessarily find another plaintext that hashes to the same thing as a given plaintext -- he must control both plaintexts to exploit this, meaning it doesn't let him attack a signature made before the attack was discovered. The "newer documents" are newer than the attack, meaning they might not be legitimately signed.

Note - this only works if you can still trust the timestamp; if the only indicator of time of signature is in the signed document itself, it could be a fake timestamp. But as a signer, you don't need to worry about old signatures, just newer ones (so transition to a better hash in the future, but don't worry so much about the past).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.