-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Matthew Toseland wrote: > What about in session setup?
To be honest I don't know enough about the key exchange protocol to give an informed answer. If it's just a question of checking that a hash matches a public key, we only need second preimage resistance and we should be safe for the moment - an attacker might be able to generate two public keys with the same hash, but he can't generate a public key matching a given hash. Cheers, Michael -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFE+HsJyua14OQlJ3sRAoZAAKCIlx2urdenA4q4JNaPNPYM/jaTHgCg3IYA X48Ws5ykOqWgcATVBwTGmOY= =wUaY -----END PGP SIGNATURE-----
