Comments on: Crypto researchers abuzz over flaws

Presenters at the Crypto 2004 conference identify faster ways to forge digital signatures with popular security algorithms.

What's the commotion all about ?

Obviosuly, since MD5 is restricted to 128 bits collisions will occur. The question is, however, can these collisions be useful - how easy is it for me to forge another document that has the same signature as the original one AND be similar enough as to not to stand out as a forge to it AND contain the "bias" that I want (e.g., increase the sum that must be paid to me in a contract). I suspect that it is virtually impossible for all practical purposes, so besides being an interesting academic issue I fail to see any imminent danger from it...

.

You're correct. It will be difficult to forge a documents signature and not have it stand out. However, I believe the security implication likes in systems such as secure transactions using SSL where it used signed certificates to to secure transactions. And from a persons view point, a certificate just looks like a bunch of random bits. In SSL, suppose a person who want to make a secure payment with his VISA to, for example, amazon.com. What happens here is that person will recieve a digitally signed certificate, which will idenitify the secure transaction. Now with the ability to find such collisions, an attacker can do this: generate 2 certificates (1 legit, 1 spoof of amazon.com) with the same MD5sum. He then sends the legit certificate to a certified authority such as Versign and gets it signed. Then he detaches the signature from the ligit one, and places it on the spoofed amazon.com certificate. Now he has a perfectly valid certificate to pretend to be amazon.

Small remark

The article states that when someone is able to generate a hash collision, he is also capable of changing code to add backdoors etc.. Well isn't it so that it would be very coincidentatal that an hash collision also would be valid code that opens a backdoor? It's not that you can choose what kind of changes you can make to create a hash collision, right? So in practice this would not be posssible if you ask me.

What replaces MD5?

The story suggested moving away from MD5. What are the
alternatives?

[pamdcoy]

Joux did SHA-0 not MD5

The Chinese researchers did MD5.