From 34efc2babd9a1a6f4c60d8f8d809fdf69e4955fd Mon Sep 17 00:00:00 2001 From: davidsarah <> Date: Sun, 11 Oct 2009 15:21:31 +0000 Subject: [PATCH] footnote 7 applies to SHA-256 [Imported from Trac: page NewCaps/WhatCouldGoWrong, version 33] --- NewCaps/WhatCouldGoWrong.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NewCaps/WhatCouldGoWrong.md b/NewCaps/WhatCouldGoWrong.md index e9e4d3e..58784e8 100644 --- a/NewCaps/WhatCouldGoWrong.md +++ b/NewCaps/WhatCouldGoWrong.md @@ -35,4 +35,4 @@ where *k* = bitlength(*K1*), *r* = bitlength(*R*), *s* = bitlength(*S*), *t* = b 6. *roadblock*/*speedbump* attacks could be restricted to holders of a read cap by use of an extra signature, as in the Elk Point 3 design (diagram at for mutable files). -7. On Merkle-Damgård hashes with an internal state that is the same size as the hash output, there are better second-preimage attacks than brute force. See . This is not significant for roadblock/speedbump attacks because the internal state will be much larger than *t* bits, but it is significant for the other second-preimage attacks. +7. On Merkle-Damgård hashes with an internal state that is the same size as the hash output (like SHA-256), there are better second-preimage attacks than brute force. See . This is not significant for roadblock/speedbump attacks because the internal state will be much larger than *t* bits, but it is significant for the other second-preimage attacks.