In my system, “resources” are granted operational certificates signed by a particular CA.

Each resource has a unique public/private key pair that it generates once. The operational cert granted by the CA signs the public key of the resource embedded as a field, along with the public key of the CA. In addition, there is a 64bit “Resource ID” embedded in the cert as well.

I intend to use a 64 bit fingerprint (SHA256 truncated) of the resource’s public key as the Resource ID.

If there was a malicious resource that desires to impersonate another’s Resource ID at the time the operational cert is granted, how difficult is it in practice with modern day compute capabilities?

Is it equivalent to the second preimage resistance of the hash? If so, is that 2^64 “trials” to find a match?

  • $\begingroup$ I think one doesn't just decide with the resource ID alone. I don't see the attack vector here. $\endgroup$
    – kelalaka
    Feb 24 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.