2
$\begingroup$

As I found out the OpenSSL implementation provided by PHP (openssl_sign) only allows DSS1 as the hashing algorithm for DSA signatures (see also my related question).

I’d prefer DSA over RSA in my use case because of the significantly shorter signatures. However, I have doubts regarding DSS1 which is basically SHA1 and therefore considered vulnerable.

The question is: Does this vulnerability also apply when used with DSA? After all the security of a signature is not (only) about finding a hash collision or fast brute-force hash calculations...

How secure or insecure would you say is using DSA with DSS1 when signing a license file for a software? Is it possible that someone can calculate the private key within a reasonable amount of time (having the public key, a message and its signature) or what’s a realistic risk? I’m aware of the fact that calculations are getting faster and faster (GPUs, cloud based services, etc.) so please include your estimation for the next couple of years.

Improve this question
$\endgroup$
2
  • $\begingroup$ Expected collision resistance of sha-1 is currently ~ $2^{64}$ instead of $2^{80}$, this only will effect signature forgery, not private key security $\endgroup$
    – Richie Frame
    Jun 5, 2014 at 19:36
  • $\begingroup$ @RichieFrame: collision resistance comes into play only if the attacker gets to pick the valid signed text and the forgery. CodeX said we was doing a license file; if he is the only one that generates the valid license files, and do not allow anyone else to "suggest" things, he need not care about collisions -- instead, he needs to worry about "second preimage" attacks. And, SHA-1 appears to be strong against that attack model. $\endgroup$
    – poncho
    Jun 5, 2014 at 19:53

1 Answer 1

Reset to default
1
$\begingroup$

While no SHA1 collisions have been found, there are some attacks:

  • ~$2^{60}$ collision attack. Estimated to cost around \$1-2 million currently in the cloud. Possibly economical soon, especially with specialized hardware.
  • Intractable preimage attacks like $2^{151}$ against reduced round variant, $2^{159}$ against full hash. (Cf. $2^{160}$ brute force on any 160-bit hash.)

How secure or insecure would you say is using DSA with DSS1 when signing a license file for a software?

Like poncho wrote in a comment, using a collision attack against a signature requires the attacker having control over what is hashed. If you only sign messages you've created yourself, e.g. random data, there is no way to mount a collision attack.

Is it possible that someone can calculate the private key within a reasonable amount of time (having the public key, a message and its signature) or what’s a realistic risk?

Even if a collision would be found, that would not compromise your key. A single collision would typically create a single valid-looking license file.

(A collision against a key signature, like against CAs, is a different matter because that allows one to create an arbitrary, valid, authorized key they can use to make their own signatures. That's why Microsoft is deprecating SHA-1 certificates.)

I’m aware of the fact that calculations are getting faster and faster (GPUs, cloud based services, etc.) so please include your estimation for the next couple of years.

Current attacks could allow collision attacks in the next few years if you sign user controlled data.

Preimage attacks would require a breakthrough to become viable. Always a possibility, but there is still enough security margin that I wouldn't worry about it.

A note on preimage vs. second preimage:

Whether a preimage or a second preimage attack would be needed depends on your setup. If the scenario is that the attacker wants to create another signed license file knowing one, he would need a second preimage, which is possibly harder. If the scenario is that the attacker knows a signature and needs to create a license file to match it, any preimage will do.

Improve this answer
$\endgroup$
5
  • $\begingroup$ Yes, I do only sign licenses I’ve created myself. However, the license information includes some customer specific information (e.g. the company name) which is basically chosen by the customer. So to be fully accurate: an attacker could purchase several licenses with predefined parts of the license. (I don’t know if that’s enough or if he’d require thousands of licenses). Does “create a single valid-looking license file.” mean that the license file would have a valid signature but with completely random content or predefined content with the correct license file structure? $\endgroup$
    – CodeX
    Jun 6, 2014 at 10:58
  • $\begingroup$ Regarding your final note: If wouldn’t make any sense to create some random text that matches the signature, because the signature needs to follow a certain file structure to be recognized as a license file and besides that a known signature can always be tracked to the original customer and therefore blacklisted. The question is mainly if it’s somehow possible to create a valid signature for a new message without knowing the private key, but knowing the information I mentioned previously (i.e. one or several full licenses). $\endgroup$
    – CodeX
    Jun 6, 2014 at 11:01
  • $\begingroup$ @CodeX, AFAICT, such a setup could allow a collision search to precalculate a pair of license files with a correct structure, but "random" data (that looks legit) in the customer information that would have the same hash. The attacker could then get one signed (i.e. submit the customer information they used) and copy the signature to the other (which could differ in the non-customer portion as well, if the attacker wants). It would be the exact same signature, though. $\endgroup$
    – otus
    Jun 6, 2014 at 11:15
  • $\begingroup$ That would still require at least a million dollar effort, even if possible, of course... So that license would have to be pretty expensive for it to make sense. $\endgroup$
    – otus
    Jun 6, 2014 at 11:29
  • $\begingroup$ Google has since announced the first SHA1 collision discussed here (security.googleblog.com/2017/02/…), granted with a humongous amount of computing power. $\endgroup$
    – Mathomatic
    Jun 16, 2017 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.