<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">On Sun, 22 Jan 2017 19:03 Viktor Dukhovni pointed out:<div class=""><br class=""></div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""><blockquote type="cite" class="">On Jan 22, 2017, at 5:34 PM, Natanael <<a href="mailto:natanael.l@gmail.com" class="">natanael.l@gmail.com</a>> wrote:<br class=""><br class=""><a href="http://www.mscs.dal.ca/~selinger/md5collision/" class="">http://www.mscs.dal.ca/~selinger/md5collision/</a><br class=""><br class="">From 2006, and since then there's even been multicollision multifiletype hash collision generators with GPU acceleration and more. <br class=""><br class="">You can trivially generate valid files with colliding hashes.<br class=""></blockquote><br class="">Let's not confuse collision attacks with second pre-image attacks.<br class=""><br class="">Tampering with existing signed objects requires a second pre-image<br class="">attack. What is the estimated complexity of the best known second<br class="">pre-image attack on MD5?</blockquote><br class=""></div><div class="">It’s true that tampering with existing signed objects requires a second pre-image attack, but creating two versions of software with the same sig could be accomplished by an entity who has the ability alter the final version of the legitimate object being signed, say by modifying a random nonce, bitmap or seed, or messing with white space in comments. This attack mode would only require a collision attack. The entity could be a mole working for loyalty to a cause, financial gain, or under duress. It might be done remotely if configuration management security is breached or the government could order cooperation e.g. in the U.S. by National Security Letter. </div><div class=""><br class=""></div><div class="">Arnold Reinhold</div></body></html>