On 28 Dec 2005, at 9:33 AM, Daniel A. Nagy wrote:
No, this is, unfortunately, not the case, as only the secret
material is
hashed. In the Klima-Rosa attack, the secret material is not
touched; it is
the public matereial that is altered.
Not as I understand it.
The point of the Klima-Rosa attack is that you damage the private
key, and persuade someone to sign something with the damaged key. You
use that bogus signature to deduce things about the private key.
I don't understand how you can have an attack on signatures that
involves only damaging the public key. That would mean that anyone
can do this, as public keys are well, public.
However, it's been years since I've looked at this. As David Shaw
said, the tag 254 s2k exists to handle this attack. If I'm missing
something or have forgotten something, please explain it to me.
Jon