H. Carvey-
This issue shouldn't affect things like SSL and hashed passwords, even
when it becomes public (as I understand it). But it does affect uses of
hashes to guarantee integrity of files on disk.
I'm not sure I follow there, either. While I can certainly see a
denial of service aspect, in order for that to happen, physical security
of the disk will have to have been compromised...and it's all over
anyway.
Could you clarify the issue of denial of service? I don't see how these
results relate to that.
If physical/system security is sufficient to guarantee images aren't
modified maliciously, why would we even need to use cryptographic
checksums?
When I compute hashes with tools I've developed, I like to use both
SHA-1 and MD5 hashes, as well as collecting the file size. The
likelihood that both hashes could be collisions while maintaining
recorded file size, and still do something useful for the attacker
(other than DoS) are very slim, I would think.
I would have to agree. As I said, two hashes eliminate the attacks if
known collisions are released, since it is unlikely those collisions
will consist of the same data.
But as I also said, there's a lot of forensics software that doesn't use
multiple hashes.
I'm sure this is the case, but at the same time, I would (like to)
think that these situations are anomolous, and not the norm. Such is
the case in many professions...and the instances where these things
happen, professionals are able to deal with them (ie, education,
training, etc.).
For the most part, I think that professionals are able to understand
the strengths and weaknesses of the tools they use.
Precisely. SHA1 is a commonly used tool in forensics. As professionals
we should keep an eye on it as things develop.
If I'm not mistaken, that's pretty much what Matt said, re: strategic,
not tactical.
Perhaps it is what he meant, but I took it more as a dismissal of the
issue.
Oh, and my hair isn't on fire.
tim
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
