Hello. A moment ago someone posted this: https://github.com/laie/WorldsFirstSha2Vulnerability
It's now gone from HN.
Is the vulnerability legit?
Ask HN: SHA2 vulnerability post was removed. Why? Is it legit?
1–10 of 14 posts
Re: Ask HN: SHA2 vulnerability post was removed. Why? Is it legit?
#2[deleted]
Re: Ask HN: SHA2 vulnerability post was removed. Why? Is it legit?
#3Yes. It's legit. No idea why it was removed. It was actually deleted, not just flagged to death.
[UPDATE] Turns out I was wrong and this is not a vulnerability at all:
https://crypto.stackexchange.com/questions/48580/fixed-point...
Re: Ask HN: SHA2 vulnerability post was removed. Why? Is it legit?
#4I cloned the repo in case it gets taken down from GitHub as well.
It's also in ipfs at /ipfs/QmXZwBkdVXBQoB7uZMUh5bzfKAHXnJT836GV1xotiQ46RW and I've pinned it on both of my ipfs servers.
If you want to do the same:
ipfs pin add QmXZwBkdVXBQoB7uZMUh5bzfKAHXnJT836GV1xotiQ46RW
git clone https://github.com/laie/WorldsFirstSha2Vulnerability
ipfs add -Hr WorldsFirstSha2Vulnerability/
Re: Ask HN: SHA2 vulnerability post was removed. Why? Is it legit?
#5[deleted]
Re: Ask HN: SHA2 vulnerability post was removed. Why? Is it legit?
#6[deleted]
Re: Ask HN: SHA2 vulnerability post was removed. Why? Is it legit?
#7A fixed point in the compression function is not a vulnerability.
Not sure why the post was deleted though.
Re: Ask HN: SHA2 vulnerability post was removed. Why? Is it legit?
#8See also https://news.ycombinator.com/item?id=14654696 where it's been reposted with comments.
Re: Ask HN: SHA2 vulnerability post was removed. Why? Is it legit?
#9New thread here https://news.ycombinator.com/item?id=14655077
Re: Ask HN: SHA2 vulnerability post was removed. Why? Is it legit?
#10https://github.com/laie/WorldsFirstSha2Vulnerability
Work by a random dude who pretends to find infinite collision so bad that he can't publish it.
No math. No explanation.
The code is a mix of single letter variables with hardly any comment.
Thank you, I'll pass.