<?xml version="1.0" encoding="ISO-8859-1"?><article xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<front>
<journal-meta>
<journal-id>1405-5546</journal-id>
<journal-title><![CDATA[Computación y Sistemas]]></journal-title>
<abbrev-journal-title><![CDATA[Comp. y Sist.]]></abbrev-journal-title>
<issn>1405-5546</issn>
<publisher>
<publisher-name><![CDATA[Instituto Politécnico Nacional, Centro de Investigación en Computación]]></publisher-name>
</publisher>
</journal-meta>
<article-meta>
<article-id>S1405-55462019000200477</article-id>
<article-id pub-id-type="doi">10.13053/cys-23-2-2994</article-id>
<title-group>
<article-title xml:lang="en"><![CDATA[Security Analysis of the Mexican Fiscal Digital Certificate System]]></article-title>
</title-group>
<contrib-group>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Rivera Zamarripa]]></surname>
<given-names><![CDATA[Luis]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Rodríguez]]></surname>
<given-names><![CDATA[Lil M.]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[León Chávez]]></surname>
<given-names><![CDATA[Miguel Ángel]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Cruz Cortés]]></surname>
<given-names><![CDATA[Nareli]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Rodríguez Henríquez]]></surname>
<given-names><![CDATA[Francisco]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
</contrib-group>
<aff id="Af1">
<institution><![CDATA[,Instituto Politécnico Nacional Centro de Investigación en Computación ]]></institution>
<addr-line><![CDATA[ ]]></addr-line>
<country>Mexico</country>
</aff>
<aff id="Af2">
<institution><![CDATA[,Consejo Nacional de Ciencia y Tecnología Instituto Nacional de Astrofísica, Óptica y Electrónica ]]></institution>
<addr-line><![CDATA[Tonantzintla Puebla]]></addr-line>
<country>Mexico</country>
</aff>
<aff id="Af3">
<institution><![CDATA[,Benemérita Universidad Autonoma de Puebla  ]]></institution>
<addr-line><![CDATA[ ]]></addr-line>
<country>Mexico</country>
</aff>
<aff id="Af4">
<institution><![CDATA[,Instituto Politécnico Nacional Centro de Investigación y de Estudios Avanzados Computer Science Department]]></institution>
<addr-line><![CDATA[ ]]></addr-line>
<country>Mexico</country>
</aff>
<pub-date pub-type="pub">
<day>00</day>
<month>06</month>
<year>2019</year>
</pub-date>
<pub-date pub-type="epub">
<day>00</day>
<month>06</month>
<year>2019</year>
</pub-date>
<volume>23</volume>
<numero>2</numero>
<fpage>477</fpage>
<lpage>490</lpage>
<copyright-statement/>
<copyright-year/>
<self-uri xlink:href="http://www.scielo.org.mx/scielo.php?script=sci_arttext&amp;pid=S1405-55462019000200477&amp;lng=en&amp;nrm=iso"></self-uri><self-uri xlink:href="http://www.scielo.org.mx/scielo.php?script=sci_abstract&amp;pid=S1405-55462019000200477&amp;lng=en&amp;nrm=iso"></self-uri><self-uri xlink:href="http://www.scielo.org.mx/scielo.php?script=sci_pdf&amp;pid=S1405-55462019000200477&amp;lng=en&amp;nrm=iso"></self-uri><abstract abstract-type="short" xml:lang="en"><p><![CDATA[Abstract: In 2005 the Mexican National tributary system (SAT) started an ambitious public key infrastructure project with the aim of providing to each Mexican citizen a public/private key pair along with a digital certificate that was issued by SAT itself. As of March 2016, approximately a total of 17 million certificates have been issued. This e-government system permits Mexican citizens to exercise a series of digital on-line services such as: tax declaration, official receipt issuing/verification, contract signing, etc. In particular, all Mexican official invoices became digital by January 2016, effectively going paperless for this service. In this paper, we carefully analyze the Mexican PKI system showing that it has several weak points that can be attacked by malicious adversaries. We report experimental evidence showing that one can launch a simple dictionary attack on SAT's password-based authentication system. We also argue that due to the fact that the hash function SHA-1 has been recently completely broken, an attacker can produce the same signature for two different documents that will verify correctly when using any old FIEL certificate that has the RSA-1204/SHA-1 signature suite.]]></p></abstract>
<kwd-group>
<kwd lng="en"><![CDATA[Information security]]></kwd>
<kwd lng="en"><![CDATA[Mexican public key infrastructure system]]></kwd>
<kwd lng="en"><![CDATA[digital certificates]]></kwd>
<kwd lng="en"><![CDATA[RSA]]></kwd>
</kwd-group>
</article-meta>
</front><back>
<ref-list>
<ref id="B1">
<label>1</label><nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Adrian]]></surname>
<given-names><![CDATA[D.]]></given-names>
</name>
<name>
<surname><![CDATA[Bhargavan]]></surname>
<given-names><![CDATA[K.]]></given-names>
</name>
<name>
<surname><![CDATA[Durumeric]]></surname>
<given-names><![CDATA[Z.]]></given-names>
</name>
<name>
<surname><![CDATA[Gaudry]]></surname>
<given-names><![CDATA[P.]]></given-names>
</name>
<name>
<surname><![CDATA[Green]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Halderman]]></surname>
<given-names><![CDATA[J. A.]]></given-names>
</name>
<name>
<surname><![CDATA[Heninger]]></surname>
<given-names><![CDATA[N.]]></given-names>
</name>
<name>
<surname><![CDATA[Springall]]></surname>
<given-names><![CDATA[D.]]></given-names>
</name>
<name>
<surname><![CDATA[Thome]]></surname>
<given-names><![CDATA[E.]]></given-names>
</name>
<name>
<surname><![CDATA[Valenta]]></surname>
<given-names><![CDATA[L.]]></given-names>
</name>
<name>
<surname><![CDATA[VanderSloot]]></surname>
<given-names><![CDATA[B.]]></given-names>
</name>
<name>
<surname><![CDATA[Wustrow]]></surname>
<given-names><![CDATA[E.]]></given-names>
</name>
<name>
<surname><![CDATA[Béguelin]]></surname>
<given-names><![CDATA[S. Z.]]></given-names>
</name>
<name>
<surname><![CDATA[Zimmermann]]></surname>
<given-names><![CDATA[P.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Imperfect forward secrecy: How diffie-hellman fails in practice]]></article-title>
<person-group person-group-type="editor">
<name>
<surname><![CDATA[Ray]]></surname>
<given-names><![CDATA[I.]]></given-names>
</name>
<name>
<surname><![CDATA[Li]]></surname>
<given-names><![CDATA[N.]]></given-names>
</name>
<name>
<surname><![CDATA[Kruegel]]></surname>
<given-names><![CDATA[C.]]></given-names>
</name>
</person-group>
<source><![CDATA[Proceedings of the 22nd Association for Computing Machinery (ACM) SIGSAC]]></source>
<year>2015</year>
<page-range>5-17</page-range><publisher-name><![CDATA[ACM]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B2">
<label>2</label><nlm-citation citation-type="">
<collab>Aristegui Noticias</collab>
<source><![CDATA[Alerta a contribuyentes: fraudes mediante suplantacion de identidad]]></source>
<year>2015</year>
</nlm-citation>
</ref>
<ref id="B3">
<label>3</label><nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Bernstein]]></surname>
<given-names><![CDATA[D. J.]]></given-names>
</name>
<name>
<surname><![CDATA[Chang]]></surname>
<given-names><![CDATA[Y.]]></given-names>
</name>
<name>
<surname><![CDATA[Cheng]]></surname>
<given-names><![CDATA[C.]]></given-names>
</name>
<name>
<surname><![CDATA[Chou]]></surname>
<given-names><![CDATA[L.]]></given-names>
</name>
<name>
<surname><![CDATA[Heninger]]></surname>
<given-names><![CDATA[N.]]></given-names>
</name>
<name>
<surname><![CDATA[Lange]]></surname>
<given-names><![CDATA[T.]]></given-names>
</name>
<name>
<surname><![CDATA[van Someren]]></surname>
<given-names><![CDATA[N.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Factoring RSA keys from certified smart cards: Coppersmith in the wild]]></article-title>
<person-group person-group-type="editor">
<name>
<surname><![CDATA[Sako]]></surname>
<given-names><![CDATA[K.]]></given-names>
</name>
<name>
<surname><![CDATA[Sarkar]]></surname>
<given-names><![CDATA[P.]]></given-names>
</name>
</person-group>
<source><![CDATA[Advances in Cryptology - ASIACRYPT 2013 Part II]]></source>
<year>2013</year>
<volume>8270</volume>
<page-range>341-60</page-range><publisher-name><![CDATA[Springer]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B4">
<label>4</label><nlm-citation citation-type="">
<collab>Edicom</collab>
<source><![CDATA[Latam e-invoicing, electronic billing platform]]></source>
<year></year>
</nlm-citation>
</ref>
<ref id="B5">
<label>5</label><nlm-citation citation-type="">
<collab>Fondo de la vivienda del instituto de seguridad y servicios sociales de trabajadores del estado</collab>
<source><![CDATA[]]></source>
<year>2018</year>
</nlm-citation>
</ref>
<ref id="B6">
<label>6</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[González-García]]></surname>
<given-names><![CDATA[V.]]></given-names>
</name>
<name>
<surname><![CDATA[Rodríguez-Henríquez]]></surname>
<given-names><![CDATA[F.]]></given-names>
</name>
<name>
<surname><![CDATA[Cruz-Cortés]]></surname>
<given-names><![CDATA[N.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[On the security of mexican digital fiscal documents]]></article-title>
<source><![CDATA[Computación y Sistemas]]></source>
<year>2008</year>
<volume>12</volume>
<numero>1</numero>
<issue>1</issue>
<page-range>25-39</page-range></nlm-citation>
</ref>
<ref id="B7">
<label>7</label><nlm-citation citation-type="">
<collab>Internet Engineering Task Force</collab>
<source><![CDATA[Updates to the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile]]></source>
<year>2013</year>
</nlm-citation>
</ref>
<ref id="B8">
<label>8</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Jiménez]]></surname>
<given-names><![CDATA[C. E.]]></given-names>
</name>
<name>
<surname><![CDATA[Criado]]></surname>
<given-names><![CDATA[J. I.]]></given-names>
</name>
<name>
<surname><![CDATA[Gascó]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Technological e-government interoperability. an analysis of iberoamerican countries]]></article-title>
<source><![CDATA[IEEE Latin America Transactions]]></source>
<year>2011</year>
<volume>9</volume>
<numero>7</numero>
<issue>7</issue>
<page-range>1112-7</page-range></nlm-citation>
</ref>
<ref id="B9">
<label>9</label><nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Klein]]></surname>
<given-names><![CDATA[D. V.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Foiling the Cracker": A survey of and improvements to password security]]></article-title>
<source><![CDATA[Proceedings 2nd Usenix Security Workshop]]></source>
<year>1990</year>
<page-range>5-14</page-range></nlm-citation>
</ref>
<ref id="B10">
<label>10</label><nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Kleinjung]]></surname>
<given-names><![CDATA[T.]]></given-names>
</name>
<name>
<surname><![CDATA[Aoki]]></surname>
<given-names><![CDATA[K.]]></given-names>
</name>
<name>
<surname><![CDATA[Franke]]></surname>
<given-names><![CDATA[J.]]></given-names>
</name>
<name>
<surname><![CDATA[Lenstra]]></surname>
<given-names><![CDATA[A. K.]]></given-names>
</name>
<name>
<surname><![CDATA[Thomé]]></surname>
<given-names><![CDATA[E.]]></given-names>
</name>
<name>
<surname><![CDATA[Bos]]></surname>
<given-names><![CDATA[J. W.]]></given-names>
</name>
<name>
<surname><![CDATA[Gaudry]]></surname>
<given-names><![CDATA[P.]]></given-names>
</name>
<name>
<surname><![CDATA[Kruppa]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Montgomery]]></surname>
<given-names><![CDATA[P. L.]]></given-names>
</name>
<name>
<surname><![CDATA[Osvik]]></surname>
<given-names><![CDATA[D. A.]]></given-names>
</name>
<name>
<surname><![CDATA[te Riele]]></surname>
<given-names><![CDATA[H. J. J.]]></given-names>
</name>
<name>
<surname><![CDATA[Timofeev]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Zimmermann]]></surname>
<given-names><![CDATA[P.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Factorization of a 768-bit RSA modulus]]></article-title>
<person-group person-group-type="editor">
<name>
<surname><![CDATA[Rabin]]></surname>
<given-names><![CDATA[T.]]></given-names>
</name>
</person-group>
<source><![CDATA[Advances in Cryptology - CRYPTO 2010]]></source>
<year>2010</year>
<volume>6223</volume>
<page-range>333-50</page-range><publisher-name><![CDATA[Springer]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B11">
<label>11</label><nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Koblitz]]></surname>
<given-names><![CDATA[N.]]></given-names>
</name>
<name>
<surname><![CDATA[Menezes]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Another look at "provable security". II]]></article-title>
<person-group person-group-type="editor">
<name>
<surname><![CDATA[Barua]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
<name>
<surname><![CDATA[Lange]]></surname>
<given-names><![CDATA[T.]]></given-names>
</name>
</person-group>
<source><![CDATA[Progress in Cryptology - INDOCRYPT2006]]></source>
<year>2006</year>
<volume>4329</volume>
<page-range>148-75</page-range><publisher-name><![CDATA[Springer]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B12">
<label>12</label><nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Lenstra]]></surname>
<given-names><![CDATA[A. K.]]></given-names>
</name>
<name>
<surname><![CDATA[Hendrik]]></surname>
<given-names><![CDATA[W.]]></given-names>
</name>
<name>
<surname><![CDATA[Lenstra]]></surname>
<given-names><![CDATA[J.]]></given-names>
</name>
</person-group>
<source><![CDATA[The development of the number field sieve]]></source>
<year>1993</year>
<volume>1554</volume>
<publisher-name><![CDATA[Springer-Verlag]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B13">
<label>13</label><nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Leon-Chavez]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Rodríguez-Henríquez]]></surname>
<given-names><![CDATA[F.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Security vulnerabilities of the mexican digital invoices by internet]]></article-title>
<source><![CDATA[International Conference on COmputing Systems and Telematics (ICCSAT 2015)]]></source>
<year>2015</year>
<page-range>1-5</page-range><publisher-name><![CDATA[IEEE]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B14">
<label>14</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Morris]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
<name>
<surname><![CDATA[Thompson]]></surname>
<given-names><![CDATA[K.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Password security: A case history]]></article-title>
<source><![CDATA[Communications of the ACM]]></source>
<year>1979</year>
<volume>22</volume>
<page-range>594-7</page-range></nlm-citation>
</ref>
<ref id="B15">
<label>15</label><nlm-citation citation-type="">
<collab>NIST</collab>
<source><![CDATA[FIPS PUB 180-1 Secure Hash Standard]]></source>
<year>1995</year>
</nlm-citation>
</ref>
<ref id="B16">
<label>16</label><nlm-citation citation-type="">
<collab>NIST</collab>
<source><![CDATA[SP 800-118 Guide to Enterprise Password]]></source>
<year>2009</year>
</nlm-citation>
</ref>
<ref id="B17">
<label>17</label><nlm-citation citation-type="">
<collab>NIST</collab>
<source><![CDATA[800-131Á Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Length]]></source>
<year>2011</year>
</nlm-citation>
</ref>
<ref id="B18">
<label>18</label><nlm-citation citation-type="">
<collab>NIST</collab>
<source><![CDATA[Transitions: Recommendation for transitioning the use of cryptographic algorithms and key lengths]]></source>
<year>2011</year>
</nlm-citation>
</ref>
<ref id="B19">
<label>19</label><nlm-citation citation-type="">
<collab>NIST</collab>
<source><![CDATA[SP 800-63-2 Electronic Authentication Guideline]]></source>
<year>2013</year>
</nlm-citation>
</ref>
<ref id="B20">
<label>20</label><nlm-citation citation-type="">
<collab>National Institute of Standards and Technology</collab>
<source><![CDATA[NIST's Policy on Hash Functions]]></source>
<year>2015</year>
</nlm-citation>
</ref>
<ref id="B21">
<label>21</label><nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Pinkas]]></surname>
<given-names><![CDATA[B.]]></given-names>
</name>
<name>
<surname><![CDATA[Sander]]></surname>
<given-names><![CDATA[T.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Securing passwords against dictionary attacks]]></article-title>
<source><![CDATA[Proceedings of the 9th Association for Computing Machinery (ACM) Conference on Computer and Communications Security, CCS '02]]></source>
<year>2002</year>
<page-range>161-70</page-range><publisher-loc><![CDATA[New York, NY, USA ]]></publisher-loc>
<publisher-name><![CDATA[ACM]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B22">
<label>22</label><nlm-citation citation-type="">
<collab>SAT</collab>
<source><![CDATA[Algoritmo para generar el RFC con homoclave para personas fisicas y morales 0610100135506]]></source>
<year>2006</year>
</nlm-citation>
</ref>
<ref id="B23">
<label>23</label><nlm-citation citation-type="">
<collab>SAT</collab>
<source><![CDATA[Recent security countermeasures put in place by SAT. Personal communication]]></source>
<year>2017</year>
</nlm-citation>
</ref>
<ref id="B24">
<label>24</label><nlm-citation citation-type="">
<collab>SEGOB</collab>
<source><![CDATA[Diario oficial de la federación]]></source>
<year>2015</year>
</nlm-citation>
</ref>
<ref id="B25">
<label>25</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Shannon]]></surname>
<given-names><![CDATA[C. E.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[A mathematical theory of communication]]></article-title>
<source><![CDATA[Bell system technical journal]]></source>
<year>1948</year>
<volume>27</volume>
<page-range>379-423</page-range></nlm-citation>
</ref>
<ref id="B26">
<label>26</label><nlm-citation citation-type="">
<collab>Sistema de Administración Tributaria</collab>
<source><![CDATA[¿Que es el SAT?]]></source>
<year>2015</year>
</nlm-citation>
</ref>
<ref id="B27">
<label>27</label><nlm-citation citation-type="">
<collab>Sistema de Administración Tributaria</collab>
<source><![CDATA[Sitio del SAT]]></source>
<year>2015</year>
</nlm-citation>
</ref>
<ref id="B28">
<label>28</label><nlm-citation citation-type="">
<collab>Sistema de Administración Tributaria</collab>
<source><![CDATA[Numero de comprobantes]]></source>
<year>2016</year>
</nlm-citation>
</ref>
<ref id="B29">
<label>29</label><nlm-citation citation-type="">
<collab>Sistema de Administracioín Tributaria</collab>
<source><![CDATA[Padron por tipo de contribuyente]]></source>
<year>2016</year>
</nlm-citation>
</ref>
<ref id="B30">
<label>30</label><nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Stevens]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Bursztein]]></surname>
<given-names><![CDATA[E.]]></given-names>
</name>
<name>
<surname><![CDATA[Karpman]]></surname>
<given-names><![CDATA[P.]]></given-names>
</name>
<name>
<surname><![CDATA[Albertini]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Markov]]></surname>
<given-names><![CDATA[Y.]]></given-names>
</name>
</person-group>
<source><![CDATA[The first collision for full sha-1. Cryptology ePrint Archive]]></source>
<year>2017</year>
</nlm-citation>
</ref>
<ref id="B31">
<label>31</label><nlm-citation citation-type="">
<collab>The Economist</collab>
<article-title xml:lang=""><![CDATA[Electronic arm-twisting]]></article-title>
<source><![CDATA[]]></source>
<year>2014</year>
</nlm-citation>
</ref>
<ref id="B32">
<label>32</label><nlm-citation citation-type="">
<collab>TOP500 Supercomputing Sites</collab>
<article-title xml:lang=""><![CDATA[TOP 10 Sites for November 2015]]></article-title>
<source><![CDATA[]]></source>
<year>2016</year>
</nlm-citation>
</ref>
<ref id="B33">
<label>33</label><nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Villaloín-Fonseca]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
<name>
<surname><![CDATA[Mora-Castro]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Bartels-Gonzaílez]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
<name>
<surname><![CDATA[Carballo-Chavarría]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Raventoís]]></surname>
<given-names><![CDATA[G. M.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Promoting quality e-government solutions by applying a comprehensive information assurance model: Use cases for digital signature]]></article-title>
<source><![CDATA[ICT for Promoting Human Development and Protecting the Environment -6th IFIP World Information Technology Forum, WITFOR 2016]]></source>
<year>2016</year>
<volume>481</volume>
<page-range>223-34</page-range><publisher-name><![CDATA[Springer]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B34">
<label>34</label><nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Wang]]></surname>
<given-names><![CDATA[X.]]></given-names>
</name>
<name>
<surname><![CDATA[Yin]]></surname>
<given-names><![CDATA[Y. L.]]></given-names>
</name>
<name>
<surname><![CDATA[Yu]]></surname>
<given-names><![CDATA[H.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Finding collisions in the full SHA-1]]></article-title>
<source><![CDATA[Advances in Cryptology - CRYPTO 2005]]></source>
<year>2005</year>
<volume>3621</volume>
<page-range>17-36</page-range><publisher-name><![CDATA[Springer]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B35">
<label>35</label><nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Weir]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Aggarwal]]></surname>
<given-names><![CDATA[S.]]></given-names>
</name>
<name>
<surname><![CDATA[Collins]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Stern]]></surname>
<given-names><![CDATA[H.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Testing metrics for password creation policies by attacking large sets of revealed passwords]]></article-title>
<source><![CDATA[Proceedings of the 17th Association for Computing Machinery (ACM) Conference on Computer and Communications Security, CCS '10]]></source>
<year>2010</year>
<page-range>162-75</page-range><publisher-name><![CDATA[ACM]]></publisher-name>
</nlm-citation>
</ref>
</ref-list>
</back>
</article>
