Problem - Kevin Tafuro

The basic idea is to take two model documents, one that the target will sign, and one
that the attacker would like the target to sign. Then, vary a few places in each of
those, and generate hashes of each document.
The difference between these two attacks is that it’s statistically a lot easier to find a
collision when you don’t have to find a collision for a particular message.
This is canonically illustrated with something called the birthday paradox. The common
analogy involves finding people with the same birthday. If you’re in a room of
253 people, the odds are just about even that one of them will share your birthday.
Surprisingly to some, if there are a mere 23 people in a room, the odds of finding two
people with the same birth date is also a bit over 50 percent.
In both cases, we’ve got a better than 50% chance after checking 253 pairs of people.
The difference is that in the first scenario, a fixed person must always be a part
of the pairings, which seriously reduces the number of possible combinations of people
we can consider. For this reason, the situation where an attacker can find a collision
between any two messages is called a birthday attack.
When a birthday attack applies, the maximum bit strength of a hash function is half
the length of the hash function’s output (the digest size). Also, birthday attacks are
often possible when people think they’re not. That is, the attacker doesn’t need to be
able to control both messages for a birthday attack to apply.
For example, let’s say that the target hashes a series of messages. An attacker can
precompute a series of hashes and wait for one of the messages to give the same
hash. That’s the same problem, even though the attacker doesn’t control the messages
the target processes.
Generally, the only reliable way to thwart birthday attacks is to use a per-message
nonce, which is typically done only with MAC constructs. Indeed, many MAC constructs
have built-in facilities for this. We discuss how to use a nonce with a hash
function in Recipe 6.8, and we discuss how to use one with MACs that aren’t built to
use one in Recipe 6.12.
Another problem that occurs with every practical cryptographic hash function is that
they are susceptible to length extension attacks. That is, if you have a message and a
hash value associated with that message, you can easily construct a new message and
hash value by extending the original message.
The MACs we recommend in this chapter avoid length-extension problems and other
attack vectors against hash functions. * We discuss how to thwart length extension
problems when using a hash function outside the context of a MAC in Recipe 6.7.
* While most of the MACs we recommend are based on block ciphers, if a MAC isn’t carefully designed, it
will still be susceptible to the attacks we describe in this section, even if it’s built on a block cipher.
252 | Chapter 6: Hashes and Message Authentication
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.