# Tag Info

3

In general (without talking about MD5): Suppose our hashfunction $H$ is a Merkle-Damgard construction using a Davies-Meyer compression function $h=(H_i,m)=E_{m_i}(H_{i-1})\oplus H_{i-1}$. Since the compression function is public, everybody is able to compute the input to the final round of the MD-Hash. In addition, if you know the input to the final round ...

5

We can attack the MAC defined by: MAC(k,m)=MD5(m||k), in a chosen-messages setup, basically because MD5's collision-resistance is broken. The adversary chooses m and m' of the same length $b\ge64$ bytes, differing only in their first $\lfloor b/64\rfloor$ 64-byte blocks, such that there is a collision after hashing these blocks of m and m'. If follows that ...

1

In one sense, no, encoding should not have an impact on security of HMAC. On the other hand, it could have an application dependent impact. Consider the following. '26' and 26 have the same HMAC. Now, assume your code receives a message, M, and an HMAC, MAC, and then does something like this if HMAC(M, private_key) == MAC: if isinstance(M, basestring): ...

2

One of the main reasons for hashing is that hashing destroys any algebraic structure that is hidden in the signatures. If you don't hash, then in most signature schemes the messages will satisfy some algebraic relation. A typical example is that $$Sign(m_1m_2)=P(Sign(m_1),Sign(m_2))$$ meaning that the signature of a product/concatenation/whatever of two ...

0

Alongside the other arguments: signing (with RSA) means exponentiating it modulo $N$ (with power $d$, the secret exponent). So anything you sign that way must be of bitsize smaller than $N$, and hashing (plus padding it) makes it so. Otherwise you'd have to split the message in small chunks and sign them, and concatenate the chunks etc. This would make the ...

0

To add another point to what Travis has already mentioned, some signature schemes like textbook RSA signature is not EUF-CMA secure under random oracle model, but Hashed-RSA signature is. So, even for a small message is would would be better to hash-then-sign, though it is not an efficiency concern.

1

Because signing is very expensive and hashing is orders of magnitude faster. If your message was a gigabyte, for instance, it would take many minutes to sign it. With hash-then-sign it is only a few seconds. Also without the hash the signature of a message would be as long as the message itself, which can be inconvenient.

0

The ciphersuites only define the properties of the SSL channel that is to be created. The certificate - including the private key usage indicated in the certificate - should be consistent with the ciphersuite. For instance if you have a ciphersuite starting with TLS_RSA then the certificate should allow encryption, and the public/private key should be RSA ...

0

The certificate is simply a file containing your public key (RSA or DSA) together with some information on e.g. how the public key is allowed to be used (for example only to authenticate a TLS connection to foo.yourdomain.com). Additionally, the file has been signed using either an RSA, DSA or ECDSA signature. Therefore, you should look up RSA/DSA/ECDSA ...

Top 50 recent answers are included