Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing the first SHA-1 collision

security.googleblog.com

Post reply on HN
Print view View original

141–150 of 524 posts

Re: Announcing the first SHA-1 collision

#141

Post by chaosfox »

cesarb wrote: post #113
chaosfox wrote: post #91

Earlier quoted context omitted.

this isn't quite true, bittorrent have checksums for each piece in the torrent, I not saying its impossible to do but its significantly harder than just finding 2 files with the same hash.

Wouldn't that make the attack easier , since you just have to manufacture a pair of pieces with the same hash, instead of having to make the whole file have the same hash?

that depends on the attacker objective, if you just want to trash the file you can just search for any piece that have a hash collision, but if you want to turn the file into a malware you will need to modify the file in a specific way, possibly spanning multiple pieces, and there's less room for fuzzing the hash.

Re: Announcing the first SHA-1 collision

#142

Post by jnwatson »

antoinealb wrote: post #92
anilgulecha wrote: post #67

Earlier quoted context omitted.

Correct, and if you have 2 images that have the same hash, you can serve one or the other at different times. This is the attack.

SHA hashes cannot protect you against the distribution site getting compromised and the hash replaced. That is why most package manager include a form of cryptographic signatures (e.g. Ed25519 for OpenBSD's). SHA and MD5 hashes are just used to protect against accidental corruption, not targeted attacks.

No. Signatures provide the same amount of integrity protection. In fact, all practical asymmetric signature schemes sign a hash. If an attacker can control what somebody signs, he can switch out signed documents using this vulnerability.

Re: Announcing the first SHA-1 collision

#143

Post by pharrlax »

jgrahamc wrote: post #95

How am I going to explain this to my wife? Actually a serious question. How do we communicate something like this to the general public?

Google found a way to crack an algorithm designed to ensure the uniqueness of documents, allowing them to be forged. Although it's expensive to do this, the price will fall, and it's a good idea to retreat to a different algorithm that does the same thing but is so much more difficult to break that no one will be able to do so for many years.

Re: Announcing the first SHA-1 collision

#144

Post by m3ta »

To put things into perspective, let the Bitcoin network hashrate (double SHA256 per second) = B and the number of SHA1 hashes calculated in shattered = G.

B = 3,116,899,000,000,000,000

G = 9,223,372,036,854,775,808

Every three seconds the Bitcoin mining network brute-forces the same amount of hashes as Google did to perform this attack. Of course, the brute-force approach will always take longer than a strategic approach; this comment is only meant to put into perspective the sheer number of hashes calculated.

Re: Announcing the first SHA-1 collision

#145

Post by throwaway2048 »

ktta wrote: post #96
babyrainbow wrote: post #86

Earlier quoted context omitted.

Malware in a video? Is that possible? How does it work?

You could have a buffer overflow attack talking advantage of a specific popular video player out there. Since video players are usually not very security focused, someone determined could do it. And since video torrents are unzipped, a single chunk can be replaced with the malicious chunk with the attack code. It can look like a tiny jitter depending on the chunk size/total video size.

You could just do this with a video you release anyways, and skip the century of GPU runtime.

This break requires you control/generate both the original and the evil file.

Re: Announcing the first SHA-1 collision

#146

Post by chaosfox »

andai wrote: post #122
chaosfox wrote: post #91

Earlier quoted context omitted.

this isn't quite true, bittorrent have checksums for each piece in the torrent, I not saying its impossible to do but its significantly harder than just finding 2 files with the same hash.

Does bt have checksums for pieces and files? I thought it was only pieces.

it is only pieces. pieces can potentially span multiple files.

Re: Announcing the first SHA-1 collision

#148

Post by BlackFly »

antoinealb wrote: post #92
anilgulecha wrote: post #67

Earlier quoted context omitted.

Correct, and if you have 2 images that have the same hash, you can serve one or the other at different times. This is the attack.

SHA hashes cannot protect you against the distribution site getting compromised and the hash replaced. That is why most package manager include a form of cryptographic signatures (e.g. Ed25519 for OpenBSD's). SHA and MD5 hashes are just used to protect against accidental corruption, not targeted attacks.

To be complete, it should be pointed out that the signature techniques you mention are signing not the document itself but a hash of the document. This attack does allow a bait and switch attack on cryptographically signed documents that utilize SHA-1 as the hash.

Re: Announcing the first SHA-1 collision

#149

Post by sktrdie »

mabbo wrote: post #74

One practical attack using this: create a torrent of some highly desirable content- the latest hot TV show in high def or whatever. Make two copies, one that is malware free, another that isn't. Release the clean one and let it spread for a day or two. Then join the torrent, but spread the malware-hosting version. Checksums would all check out, other users would be reporting that it's the real thing, but now you've g…

But you can't control the data in the malware. It will be garbage.
Post reply on HN