<?xml version="1.0" encoding="ISO-8859-1"?><article xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<front>
<journal-meta>
<journal-id>1405-5546</journal-id>
<journal-title><![CDATA[Computación y Sistemas]]></journal-title>
<abbrev-journal-title><![CDATA[Comp. y Sist.]]></abbrev-journal-title>
<issn>1405-5546</issn>
<publisher>
<publisher-name><![CDATA[Instituto Politécnico Nacional, Centro de Investigación en Computación]]></publisher-name>
</publisher>
</journal-meta>
<article-meta>
<article-id>S1405-55462019000401181</article-id>
<article-id pub-id-type="doi">10.13053/cys-23-4-3103</article-id>
<title-group>
<article-title xml:lang="es"><![CDATA[Sobre el impacto del colisionador SHA-1 en las firmas digitales mexicanas con valor legal]]></article-title>
<article-title xml:lang="en"><![CDATA[On the Impact of the SHA-1 Collider on Mexican Digital Firms with Legal Value]]></article-title>
</title-group>
<contrib-group>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Dominguez Perez]]></surname>
<given-names><![CDATA[Luis J.]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Gómez Trujillo]]></surname>
<given-names><![CDATA[Laiphel M.]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Cruz Cortés]]></surname>
<given-names><![CDATA[Nareli]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Rodríguez Henríquez]]></surname>
<given-names><![CDATA[Francisco]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
</contrib-group>
<aff id="Af1">
<institution><![CDATA[,Centro de Investigación en Matemáticas  ]]></institution>
<addr-line><![CDATA[ Zacatecas]]></addr-line>
<country>Mexico</country>
</aff>
<aff id="Af2">
<institution><![CDATA[,Instituto Politécnico Nacional Centro de Investigación y de Estudios Avanzados Departamento de Computación]]></institution>
<addr-line><![CDATA[ ]]></addr-line>
<country>Mexico</country>
</aff>
<aff id="Af3">
<institution><![CDATA[,Instituto Politécnico Nacional Centro de Investigación en Computación ]]></institution>
<addr-line><![CDATA[ ]]></addr-line>
<country>Mexico</country>
</aff>
<pub-date pub-type="pub">
<day>00</day>
<month>12</month>
<year>2019</year>
</pub-date>
<pub-date pub-type="epub">
<day>00</day>
<month>12</month>
<year>2019</year>
</pub-date>
<volume>23</volume>
<numero>4</numero>
<fpage>1181</fpage>
<lpage>1190</lpage>
<copyright-statement/>
<copyright-year/>
<self-uri xlink:href="http://www.scielo.org.mx/scielo.php?script=sci_arttext&amp;pid=S1405-55462019000401181&amp;lng=en&amp;nrm=iso"></self-uri><self-uri xlink:href="http://www.scielo.org.mx/scielo.php?script=sci_abstract&amp;pid=S1405-55462019000401181&amp;lng=en&amp;nrm=iso"></self-uri><self-uri xlink:href="http://www.scielo.org.mx/scielo.php?script=sci_pdf&amp;pid=S1405-55462019000401181&amp;lng=en&amp;nrm=iso"></self-uri><abstract abstract-type="short" xml:lang="es"><p><![CDATA[Resumen Las garantías de seguridad de las firmas digitales tipo RSA están basadas en dos hipótesis principales: La primera, en el supuesto de que la factorización de números enteros gigantescos es un problema computacionalmente difícil; La segunda, en el supuesto de que las funciones picadillo producen un digesto único para cualquier documento digital a firmar. Bajo estas hipótesis en las últimas décadas en México y en otros países, se han promulgado leyes que estipulan el uso de firmas digitales conformadas por la combinación del algoritmo RSA y la función picadillo SHA-1. Esta selección de algoritmos es conocida como la firma digital RSA-SHA-1. Dichas firmas digitales pueden utilizarse para validar contratos digitales de manera legal. Sin embargo, recientemente, la función picadillo SHA-1 ha sufrido un ataque de falsificación en el que dado un documento arbitrario y su digesto SHA-1, es posible generar un segundo documento con el mismo digesto. En otras palabras, el ataque permite encontrar parejas arbitrarias de documentos que comparten el mismo digesto. Esta situación ha provocado que el protocolo RSA-SHA-1, este en riesgo. En este artículo, discutimos algunas de las repercusiones en la seguridad de la información de los documentos legales firmados mediante este esquema. También se presentan algunas contramedidas para mitigar esta vulnerabilidad.]]></p></abstract>
<abstract abstract-type="short" xml:lang="en"><p><![CDATA[Abstract Security warranties of the RSA-type digital signatures are based on two main hypothesis: First, in the assumption that factoring gigantic integer numbers is a computationally unfeasible problem. Second, in the assumption that hash functions produce a unique digest for any digital document. With these two hypothesis in mind, in the last decades in México, and also in other countries, legislation has been enacted to legalize digital signatures. In México, the combination of the RSA algorithm and the SHA-1 hash function can be used to legally validate digital contracts. This selection of algorithms is known as the RSA-SHA-1 digital signature. However, recently the SHA-1 hash function has suffered a falsification attack in which, given an arbitrary document for which the SHA-1 digest was produced, it is possible to generate a second document with the same digest. In other words, this attack permits to find arbitrary pairs of documents that share the same digest. This situation has provoked that the RSA-SHA-1 algorithm used to sign legal contracts is on risk to be broken. In this article, some of the repercussions in the information security of the legal documents signed with this protocol are discussed. We also discuss some countermeasures that can mitigate this vulnerability.]]></p></abstract>
<kwd-group>
<kwd lng="es"><![CDATA[SHA]]></kwd>
<kwd lng="es"><![CDATA[firmas digitales]]></kwd>
<kwd lng="es"><![CDATA[RSA]]></kwd>
<kwd lng="en"><![CDATA[SHA]]></kwd>
<kwd lng="en"><![CDATA[digital signatures]]></kwd>
<kwd lng="en"><![CDATA[RSA]]></kwd>
</kwd-group>
</article-meta>
</front><back>
<ref-list>
<ref id="B1">
<label>1</label><nlm-citation citation-type="">
<collab>Banxico</collab>
<source><![CDATA[Certificados de la IES]]></source>
<year>2012</year>
</nlm-citation>
</ref>
<ref id="B2">
<label>2</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Calderón Hinojosa]]></surname>
<given-names><![CDATA[F.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Ley de Firma Electrónica Avanzada]]></article-title>
<source><![CDATA[Diario Oficial de la Federación]]></source>
<year>2012</year>
</nlm-citation>
</ref>
<ref id="B3">
<label>3</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Fox Quesada]]></surname>
<given-names><![CDATA[V.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Registro Público de Comercio]]></article-title>
<source><![CDATA[Diario Oficial de la Federación]]></source>
<year>2003</year>
</nlm-citation>
</ref>
<ref id="B4">
<label>4</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Gutiérrez Ortiz Mena]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Anexo 20 de la resolución miscelánea fiscal para 2011]]></article-title>
<source><![CDATA[Diario Oficial de la Federación]]></source>
<year>2010</year>
</nlm-citation>
</ref>
<ref id="B5">
<label>5</label><nlm-citation citation-type="">
<collab>Information Technology Laboratory NIST</collab>
<source><![CDATA[Fips pub 180-4 federal information processing standards publication secure hash standard (shs)]]></source>
<year>2017</year>
</nlm-citation>
</ref>
<ref id="B6">
<label>6</label><nlm-citation citation-type="">
<collab>Internet Engineering Task Force (IETF)</collab>
<source><![CDATA[Updates to the internet X.509 public key infrastructure certificate and certificate revocation list (CRL) profile]]></source>
<year>2013</year>
</nlm-citation>
</ref>
<ref id="B7">
<label>7</label><nlm-citation citation-type="">
<collab>NIST</collab>
<source><![CDATA[Hash functions]]></source>
<year>2015</year>
</nlm-citation>
</ref>
<ref id="B8">
<label>8</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Rivest]]></surname>
<given-names><![CDATA[R.]]></given-names>
</name>
<name>
<surname><![CDATA[Shamir]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Adleman]]></surname>
<given-names><![CDATA[L.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[A method for obtaining digital signatures and public-key cryptosystems]]></article-title>
<source><![CDATA[Communications of the ACM]]></source>
<year>1977</year>
<volume>21</volume>
<numero>2</numero>
<issue>2</issue>
</nlm-citation>
</ref>
<ref id="B9">
<label>9</label><nlm-citation citation-type="journal">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Rojas Ibáñez]]></surname>
<given-names><![CDATA[J.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Anexo 20 de la resolución miscelánea fiscal para 2012]]></article-title>
<source><![CDATA[Diario Oficial de la Federación]]></source>
<year>2011</year>
</nlm-citation>
</ref>
<ref id="B10">
<label>10</label><nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Stevens]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Bursztein]]></surname>
<given-names><![CDATA[E.]]></given-names>
</name>
<name>
<surname><![CDATA[Karpman]]></surname>
<given-names><![CDATA[P.]]></given-names>
</name>
<name>
<surname><![CDATA[Albertini]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Markov]]></surname>
<given-names><![CDATA[Y.]]></given-names>
</name>
</person-group>
<source><![CDATA[The first collision for full SHA-1. Cryptology ePrint Archive]]></source>
<year>2017</year>
</nlm-citation>
</ref>
<ref id="B11">
<label>11</label><nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Stevens]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Bursztein]]></surname>
<given-names><![CDATA[E.]]></given-names>
</name>
<name>
<surname><![CDATA[Karpman]]></surname>
<given-names><![CDATA[P.]]></given-names>
</name>
<name>
<surname><![CDATA[Albertini]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Markov]]></surname>
<given-names><![CDATA[Y.]]></given-names>
</name>
</person-group>
<source><![CDATA[SHAttered]]></source>
<year>2017</year>
</nlm-citation>
</ref>
<ref id="B12">
<label>12</label><nlm-citation citation-type="book">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Stevens]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
<name>
<surname><![CDATA[Sotirov]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Appelbaum]]></surname>
<given-names><![CDATA[J.]]></given-names>
</name>
<name>
<surname><![CDATA[Lenstra]]></surname>
<given-names><![CDATA[A.]]></given-names>
</name>
<name>
<surname><![CDATA[Molnar]]></surname>
<given-names><![CDATA[D.]]></given-names>
</name>
<name>
<surname><![CDATA[Osvik]]></surname>
<given-names><![CDATA[D. A.]]></given-names>
</name>
<name>
<surname><![CDATA[de Weger]]></surname>
<given-names><![CDATA[B.]]></given-names>
</name>
</person-group>
<article-title xml:lang=""><![CDATA[Short chosen-prefix collisions for MD5 and the creation of a rogue CA certificate]]></article-title>
<person-group person-group-type="editor">
<name>
<surname><![CDATA[Halevi]]></surname>
<given-names><![CDATA[S.]]></given-names>
</name>
</person-group>
<source><![CDATA[Advances in Cryptology - CRYPTO 2009]]></source>
<year>2009</year>
<page-range>55-69</page-range><publisher-loc><![CDATA[Berlin, Heidelberg ]]></publisher-loc>
<publisher-name><![CDATA[Springer Berlin Heidelberg]]></publisher-name>
</nlm-citation>
</ref>
<ref id="B13">
<label>13</label><nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Torvalds]]></surname>
<given-names><![CDATA[L.]]></given-names>
</name>
</person-group>
<source><![CDATA[The sky isn't failing. Google+]]></source>
<year>2017</year>
</nlm-citation>
</ref>
<ref id="B14">
<label>14</label><nlm-citation citation-type="">
<person-group person-group-type="author">
<name>
<surname><![CDATA[Weis]]></surname>
<given-names><![CDATA[S.]]></given-names>
</name>
</person-group>
<source><![CDATA[SHA1 collider]]></source>
<year>2017</year>
</nlm-citation>
</ref>
</ref-list>
</back>
</article>
