Ask HN: SHA2 vulnerability post was removed. Why? Is it legit?

Post by user5994461 » Wed, Jun 28, 2017, 3:50 PM UTC

jstanley wrote: post #11

user5994461 wrote: post #10

https://github.com/laie/WorldsFirstSha2Vulnerability Work by a random dude who pretends to find infinite collision so bad that he can't publish it. No math. No explanation. The code is a mix of single letter variables with hardly any comment. Thank you, I'll pass.

The code sets up a sha256 state, then adds some input to sha256, and then demonstrates that the sha256 state is the same as it was. I'd say that counts as a vulnerability. It doesn't mean sha256 is broken, but it's a vulnerability. EDIT: All of this modulo a rigged sha256.py, of course

Post by lisper » Wed, Jun 28, 2017, 3:53 PM UTC

user5994461 wrote: post #12

jstanley wrote: post #11

Earlier quoted context omitted.

The code sets up a sha256 state, then adds some input to sha256, and then demonstrates that the sha256 state is the same as it was. I'd say that counts as a vulnerability. It doesn't mean sha256 is broken, but it's a vulnerability. EDIT: All of this modulo a rigged sha256.py, of course

You can google for existing sha256 collisions, nothing special in hard coding one. Google it and you'll find the source, if it's a popular collision already published in papers.