Subject: RE: [Cfrg] Re: one question about hash

From: Tim Dierks <[email-masked]>
Date: Tue, 14 Oct 2003 11:42:41 -0400

At 07:18 PM 7/11/2003, Hallam-Baker, Phillip wrote:
>I am certainly not arguing for an ad hoc change to the algorithm.
>
>However I do believe that in future we should consider vulnerability to
>extension attacks as an unacceptable feature of a digest.

Three months later, a modest proposal from an admitted non-crpytographer: 
wouldn't SHA-1 be protected against extension attacks if it had any 
operation added after the calculation of the final block? For example, 
flipping the last bit in the hash.

I don't see how an extension attack would be possible with this kind of 
modification I'll steer clear of the question as to whether such a simple 
change might be too easy to attack inside of the algorithm of SHA-1; the 
flip-a-single-bit proposal should only be taken as offering the general 
idea that a simple transformation after the final block operation can 
remove this attack. Also, I believe it's clear that any such reversible 
transformation cannot reduce the security of the hash's current properties.

Of course, I concur that it may not be important for a secure hash to 
protect against extensibility; on the other hand, if it's easily possible, 
it's not clear to me that it shouldn't.

Note that this doesn't require a change to SHA-1; if it works, it can be 
implemented in protocols which wish to protect against extensibility. (Of 
course, there are lots of other ways to protect against extension in a 
protocol, so maybe that's not of value.)

  - Tim

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg