GnuPG 2.1.0 "modern" released [LWN.net]

GnuPG 2.1.0 "modern" released

Posted Nov 13, 2014 16:55 UTC (Thu) by raven667 (subscriber, #5198)
In reply to: GnuPG 2.1.0 "modern" released by dlang
Parent article: GnuPG 2.1.0 "modern" released

> but even the pre-image attacks don't result in a document that looks like a reasonable e-mail, or other human readable document (even a computer interpreted binary needs a bunch of 'junk' thrown in to create a match)

While you would probably notice in an email it is demonstrated that you can create JPEGs with the same MD5 and it's not even hard anymore.

http://natmchugh.blogspot.co.uk/2014/10/how-i-created-two...

to post comments

GnuPG 2.1.0 "modern" released

Posted Nov 13, 2014 19:54 UTC (Thu) by dlang (guest, #313) [Link]

so that means that when you can throw in a huge amount of essentially random data without the user noticing, then signatures involving md5 are not that useful

But if you limit the problem space to something that is human readable and makes sense (in a human or programming language without large blobs), then it becomes a MUCH harder problem.

And if you are trying to alter what someone said to make it seem like they actually said something else (as opposed to just vandalizing something, for which deleting the data is just as effective, and not protected by any encryption/signing), then you are even more contrained.

If you have signatures on code, then before any weakness in the hash is significant you need to be able to replace it with new code that will compile, and doesn't scream "something wrong" when a human looks at it.