Timeline for What is the reason to separate domains in the internal hash algorithm of a merkle tree hash?
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 31, 2017 at 15:50 | vote | accept | curious | ||
| Jan 31, 2017 at 14:46 | comment | added | Christian Matt | What do you mean "detectable in the verification phase"? The reference describes a method for building a hash function MTH for hashing lists. The two lists I've described above are different and are hashed to the same value. Therefore, this is a second-preimage attack on MHT. The height of the tree or other internal details are not included in the output of MHT and are therefore not relevant for this attack. | |
| Jan 31, 2017 at 14:36 | comment | added | curious | but that will change the height of the tree, which will be detactable in the verification phase, so that attack is not valid... | |
| Jan 31, 2017 at 0:30 | comment | added | Christian Matt | I found another List, namely $(h_1 \| h_2)$ that is hashed to the same value as the list $(e_1, e_2)$. I don't have to (and cannot) find a collision for $H$ itself, but for the scheme built from $H$ for hashing lists. | |
| Jan 31, 2017 at 0:26 | comment | added | curious | I do not understand why it is now 'easy'. What you describe as an attack in the first paragraph is not an attack... The publicly known $h_1||h_2$ is hashed to a value. You did not show that you can find other $h'$, whereby $H(h')=H(h_1||h_2)$ So how you treat that as an attack? | |
| Jan 31, 2017 at 0:01 | history | answered | Christian Matt | CC BY-SA 3.0 |