2

If I have a 4096 DSA private key used for signing binaries, and I want to ensure that a partner has an identical server using the same private key, can I send the md5sum of the private keys over an insecure channel to verify this, without meaningfully compromising the key?

That is, would publishing an md5sum of the private key make it feasible for an attacker to generate a valid signature for an unauthorised binary?

5 Answers 5

3

You can use the MD5 cryptography hash without any serious concern but why not consider using the public key to confirm the private key in question.

You could have the partner sign a sample binary and use the public key to confirm the signature and thereby confirm the private key.

If you want to work outside the signing infrastructure you could use a PKI utility like openssl to confirm the key set using the partner's private key and the public key.

2
  • I will eventually confirm that signatures of the same binary match exactly, but I want to use a md5sum of every file on the servers to confirm that the servers are still identical.
    – Inquirer
    Commented May 5, 2015 at 15:10
  • 1
    @Inquirer you should be using SHA256 or other more modern hashes
    – Natanael
    Commented May 28, 2015 at 10:57
2

In some cases it might actually compromise the security of it.

http://www.di.ens.fr/~fouque/pub/crypto07b.pdf

HMAC-MD5 has a key recovery attack in the upper end of achievable but impractical, although attacks only get better over time.

2
  • Looking at this paper I don't think it is relevant; I am not using md5sum to hash my signed binaries, but rather just on the private key itself.
    – Inquirer
    Commented May 6, 2015 at 13:19
  • @Inquirer doesn't make a difference - the secret input was successfully extracted.
    – Natanael
    Commented May 28, 2015 at 10:56
2

Looking at your comment on @zedman9991's answer; if you want to check that the servers' filesystems are identical, why not generate one hash for the whole filesystem, rather than one hash per file?

This will likely fail on two different severs since operating systems generate files like candy, timestamps / MAC addresses will differ, etc, so it might be better to hash-and-compare only the directory subtree(s) containing your security-critical binaries / private keys.

This SO question is about how to do that in Linux.

2
  • 1
    My suggestion is a list of hashes that then are "merged" with a Merkle tree hash, such that it have one big hash that can be used to verify all files that match.
    – Natanael
    Commented May 6, 2015 at 0:10
  • 1
    I actually like knowing what has changed between the servers, so what I will now use looks similar to find / -path /proc -prune -o -path /sys -prune -o -path /dev -prune -o -type f -exec md5sum {} \; | grep -v private_key
    – Inquirer
    Commented May 6, 2015 at 14:26
1

Although it is only the collision resistance property of MD5 that has so far been compromised, I would not use MD5 for any cryptographic purposes even though in your case an attacker would need to compromise the pre-image resistance. Use a secure algorithm such as SHA-256.

1

Tracking down the links referenced in the answers, I think it would be safe.

Out of an abundance of caution, I will exclude the private key from the list of md5sum values I allow to be stored on computers connected to the Internet. I will then use the signatures generated for the same binary to confirm the excluded private keys are identical.

Even if preimage resistance was compromised for md5sum, an attacker would gain nothing useful, since they need the actual key, not some collection of bits that has the same hash as the key; the attacker would need essentially a way to get the inverse of the hash function, that is, a way to quickly generate all the patterns in a given range that hashed to the published hash; or perhaps some deep relationship between md5sum hashes and DSA based signatures.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .