Paper 2003/245

A Key Substitution Attack on SFLASH^{v3}

Willi Geiselmann and Rainer Steinwandt

Abstract

A practical key substitution attack on SFLASH^{v3} is described: Given a valid (message, signature) pair (m,\sigma) for some public key v_0, one can derive another public key v_1 (along with matching secret data) such that (m,\sigma) is also valid for v_1. The computational effort needed for finding such a `duplicate' key is comparable to the effort needed for ordinary key generation.