In my question (and answer) about a partial hash code used within a signature application I found out that partial hash codes are sometimes used within protocols with a relatively restricted security tokens such as smart cards.

In the comments below the answer I mused that the partial hash makes sense over a full hash. If a octet string representing a full hash is send then the octet string can contain any data, which would then be used in the signature scheme instead of the hash. This way it could be possible to create a covert channel.

Two related questions:

  1. Are covert channels considered a significant threat in signature schemes?
  2. Are partial hashes used in other protocols than the one described above?
  • $\begingroup$ In theory, covert channels are a threat if you say so (by giving the attacker this power). In practice, covert channels are definitely a threat, but it depends very much on the context: What kind of machine is used, how easy is it to corrupt the system, etc. Additionally: You can not get rid of all covert channels, unless you disable all communication to/from a device. There are so many aspects, where you can embed information in a networking protocol and/or messages, that you can't say that there is no covert information. $\endgroup$
    – tylo
    Commented Sep 1, 2014 at 11:14
  • $\begingroup$ @tylo Agreed. And it would be rather easy to couple data or meaning to a hash as well. I think you need to be able to trust the data you are signing. The question is then if the partial hash is adding security or not. Of course, a covert channel in signed data is of more importance than a covert channel elsewhere (as there is user consent to create the signature, possibly at a specific time/place). $\endgroup$
    – Maarten Bodewes
    Commented Sep 1, 2014 at 11:21
  • $\begingroup$ I think that in most scenarios, where covert channels are an issue, "user consent" has no meaning: If you assume the computer to be corrupted (such that the attacker has enough control over it to hide information in the traffic), then it is quite hard to ensure that the user clicked on the consent button and not the attacker. But it really comes down on your assumptions about the entire system and the attacker. $\endgroup$
    – tylo
    Commented Sep 1, 2014 at 11:28
  • $\begingroup$ @tylo Well, for security tokens/smart cards there is PIN or biometric authentication. That's some kind of "user consent". I agree that there is still plenty that can be done by a malicious terminal though; that's actually one of my peeves against this kind of security - at some point in time you need to trust the terminal anyway. I mean, if a covert channel is possible, then it is also possible to sign any other content, which is much worse. $\endgroup$
    – Maarten Bodewes
    Commented Sep 1, 2014 at 11:56


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.