We are talking about the realm of (single) DES security here (i.e. ~
DES-X variant) and one will need all the additional bits. The question
of how much can we actually get beyond DES may not be so important in
the context of this thread.
Recall that my initial post doesn't claim any immediate attack on SHA-1
or a specific weakness of OpenPGP. I am looking for a solution that we
can implement in a few years to move to the full 128 bit security (or
closer to it). This means that we need to have a method now so that we
can begin to slowly integrate it.
IMO the upgrade can be done "cheaply", without disruption, so my thought
is why not do it anyway?
On 01/04/2013 02:21 PM, Christian Aistleitner wrote:
Hi Andrey,
On Fri, Jan 04, 2013 at 11:56:36AM -0800, Andrey Jivsov wrote:
On 01/04/2013 02:53 AM, Christian Aistleitner wrote:
Do you have any data / research underpinning this 51 (Besides
Wikipedia)?
After all, the cited Wikipedia page links to the retracted variant of
an article :-(
Otherwise, the best /theoretical/ result that I know of is just
above 60.
It looks like this is from the paper "Classification and Generation of
Disturbance Vectors for Collision Attacks against SHA-1"
published in 2011 in Designs, Codes and Cryptography
[...]
I guess you are aware of the fact that in recent variants of the
article, the 51 is gone and that there is a reason why I wrote
“retracted variant” in my original mail :-)
Should we rather say that the _practical_ value is about 60 [...]
http://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
Practical has more than just one meaning, just as theoretical :-)
As the post you reference only says
If Stevens' attack of $2^{60}$ SHA-1 operations serves as the
baseline [...]
and does not say that “Stevens' attack” is practical (or “practical”
in what sense), I am convinced you have read in Stevens' research to
underpin your claim. For example you might have come across Stevens'
2012 PhD thesis and have read passages as
[...] and this chosen-prefix collision attack against SHA-1 remains a
theoretical attack.
in section 7.7.3 (but that's somewhat out of context), or more
general statements as
[...] even though no practical collision attacks against SHA-1 or
actual colliding messages are known yet.
from section 8.4.
But be things as they may, if you know better than Stevens himself and
can make his results even more practical, please step up and share
your work.
All the best,
Christian
_______________________________________________
openpgp mailing list
openpgp(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/openpgp