News for hackers. Stuff that matters.

A comment on What's the matter with PGP?. Parent comment

Re:What's the matter with PGP? by croikle on Wednesday August 13, 2014 @10:13PM (#8175773)
I'm aware of simple brute-force attacks on short key IDs [0], which are just the last 32 bits of the fingerprint (e.g. 438CF0E2). With significant effort, one might be able to extend that to 64 bits.

I'd be much more surprised by a full fingerprint match. Wouldn't that imply a SHA-1 collision?

[0] http://www.asheesh.org/note/debian/short-key-ids-are-bad-new...

[ Parent | on HN ]
Re:What's the matter with PGP? by zimbatm on Thursday August 14, 2014 @06:21PM (#8180162)
Yes I was referring to the 64bit long key ID. The full fingerprint is a SHA-1 and not vulnerable.

See https://www.debian-administration.org/users/dkg/weblog/105

[ Parent | on HN ]
Re:What's the matter with PGP? by AlyssaRowan on Friday August 15, 2014 @02:03AM (#8181162)
The 64-bit has been done: I've seen it. 0000000000000001, I think?
[ Parent | on HN ]