Let's say that I have a 4096-bit RSA key and when I sign data, I typically use SHA-512. As far as I understand it, the hash algorithm used to sign/verify a message is specified in the message. If a hash algorithm is susceptible to collisions, then it doesn't matter how large my RSA key is, and signatures can be forged.

So what is to prevent someone from forging a signature by selecting MD5 as the hash algorithm used to "sign" a message?


To forge a message using a hash collision, you need to generate a signature (using that hash function to sign a "good" message); then that signature is also a valid signature for the "bad" message.

So, to prevent this from being a concern, you just never sign a message using MD5 as your hash function. Yes, the attacker can generate a "good" and a "bad" message with the same MD5 hash, but unless he can convince you to sign the "good" message using MD5, that doesn't help him. If you always use SHA-512 when you sign messages, that means that the attacker must find a collision in the SHA-512 hash function; we believe that's infeasible.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.