Language Selection

English French German Italian Portuguese Spanish

Hashing exploit threatens digital security

Filed under

Cryptographers have found a way to snip a digital signature from one document and attach it to a fraudulent document without invalidating the signature and giving the fraud away.

The development means that attackers could potentially forge legal documents, load certified software with bogus code, or turn a digitally-signed letter of recommendation into one that authorises access to private information.

Digital signatures are used to authenticate website connections, emails and legal documents in some countries. They work because they are unique to the file or software that is signed, as they are created from the contents of the signed file. Therefore, if someone tries to cut a digital signature from one document and stick it to another, the signature fails because it no longer matches the document.

But now Stefan Lucks of the University of Mannheim and Magnus Daum of the Ruhr-University, Bochum, both in Germany, have come up with a way to create two documents that both have the same digital signature.

The attack exploits recently discovered holes in a type of publicly available algorithm called a hash function. These algorithms convert a digital file into a fixed-length string of bits (made up of "0"s and "1"s) called a hash, which is considered unique. The hash is then bound up with the digital signatory's key to generate their signature. The signature is verified by a trusted third party that removes the key and compares the remaining number with a hash of the document.

Full Article.

More in Tux Machines

Chrome Remote Desktop is used on Deepin 15 for remote assistance

If you’ve installed the latest pre-stable edition of Deepin 15 (Deepin 2015), which I just wrote about earlier today (see Deepin 15. This could be the best Linux desktop distribution of the year), a module you’ll find in the Control Center, is Remote Assistance. Read more

Itty bitty ARM module starts at $27

Variscite’s rugged, 50 x 25mm “DART-6UL” COM runs Linux on an i.MX6 UltraLite SoC, offers NAND, eMMC, and wireless, and starts at $27 in volume. In April, Variscite announced the world’s smallest i.MX6 computer-on-module with its 50 x 20mm, Freescale i.MX6-based DART-MX6. At 50 x 25mm, the DART-6UL doesn’t quite match those dimensions, but it offers greater power efficiency, making it well suited for IoT applications and battery-powered devices. Variscite claims it consumes only 5mA in suspend mode. Read more