Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing the first SHA-1 collision

security.googleblog.com

Post reply on HN
Print view View original

261–270 of 524 posts

Re: Announcing the first SHA-1 collision

#261

Post by duozerk »

hatsunearu wrote: post #234
comboy wrote: post #154

Earlier quoted context omitted.

I wonder if SHA1 was used instead of SHA256 for Bitcoin mining, how much optimization these SHA1 discoveries would bring to the mining process (since it's more like partial brute forcing rather than finding collisions) i.e. what would be the percentage difference in the difficulty because of them - on the long run, since it takes some time to implement those things as ASICs.

>since it takes some time to implement those things as ASICs. not really. it's just a few man-years to develop a kickass hdl and a lot of money and you're good to go. all bitcoin did was create a massive market for sha1 asics. i wonder if those asics can be used to reduce the 110 gpu-years down to a few asic-years?

> all bitcoin did was create a massive market for sha1 asics

A massive market for SHA256(SHA256(value)) asics, actually; so no, they can hardly be used for anything other than bitcoin mining.

Re: Announcing the first SHA-1 collision

#262

Post by problems »

jakob223 wrote: post #255
problems wrote: post #242

Earlier quoted context omitted.

A few considerations though: - Google used GPUs, much of the Bitcoin network relies on fully custom ASICs now and mining without them isn't really profitable anymore - SHA1 hashes can also be computed over twice as fast as SHA256 even on GPUs, so if someone were to go out and build SHA1 ASICs, you could probably do this very, very fast. It's almost certain that intelligence agencies could invest this effort to say, b…

> say, break SHA1 SSL certs Maybe, and probably, but probably not within the scope of this attack. This attack relies on being able to have a large similar prefix and a lot of control over further internal data; SSL certs are somewhat more constrainted.

Would a TLS certificate not offer such a large similar prefix? Just change the domain to a wildcard or something like the RapidSSL MD5 attack from a few years back.

Re: Announcing the first SHA-1 collision

#265

Post by danielweber »

manwithaplan wrote: post #216

Seeing how they ridicule MD5, I think they should have spent a bit more time on the proof PDFs, and have their MD5 digests collide also.

No, that's irrelevant. You don't hold off showing the first SHA-1 collision to have it have MD5 collisions as well.

I don't think anyone in the field is surprised that the MD5 signatures are different for this file.

Re: Announcing the first SHA-1 collision

#266

Post by anilgulecha »

koolba wrote: post #183
anilgulecha wrote: post #165

Earlier quoted context omitted.

Magnet URI hash is SHA1. A hash collision can still be used as an attack if you create 2 torrents with the same hash and then distribute.

That's not an issue with the torrents. It's an issue with the magnet URI format for referncing torrents. The "good" torrent would not be susceptible to attack via this receiving the entire torrent file directly (say over HTTPS) is fine.

Torrent files have been deprecated for a while. Magnet URI is the the preferred/default method of sharing. TPB did this in 2012[1].

[1] https://torrentfreak.com/the-pirate-bay-dumps-torrents-12022...

Re: Announcing the first SHA-1 collision

#267

Post by danielweber »

mckoss wrote: post #37

Computing a collision today costs about $100K from my reading of the paper. So most uses of SHA1 are protecting documents of far lower value, and would not be likely attack targets (today).

There are many areas of security where you can genuinely get by with obfuscation, hoping the attacker looks elsewhere, or general security-through-obscurity.

You can't in crypto. When the entire system relies on an axiom being true, you need to make sure it's true. The attacks are only going to get better. The attacks are going to come from the future. The embedded systems will not be replaced in time.

Re: Announcing the first SHA-1 collision

#268

Post by refulgentis »

jwilk wrote: post #264

> How did you leverage the PDF format for this attack? > A picture is worth a thousand words, so here it is. > http://shattered.io/static/pdf_format.png This picture is meaningless to me. Can someone explain what's going on?

One can insert arbitrary data into JPGs. Given that, the researchers embedded a JPG in a PDF, and manipulated the arbitrary data until it resulted in a collision.

Re: Announcing the first SHA-1 collision

#269

Post by JoshTriplett »

problems wrote: post #262
jakob223 wrote: post #255

Earlier quoted context omitted.

> say, break SHA1 SSL certs Maybe, and probably, but probably not within the scope of this attack. This attack relies on being able to have a large similar prefix and a lot of control over further internal data; SSL certs are somewhat more constrainted.

Would a TLS certificate not offer such a large similar prefix? Just change the domain to a wildcard or something like the RapidSSL MD5 attack from a few years back.

> Just change the domain to a wildcard or something

Or change a CA:FALSE certificate to CA:TRUE, so you have your own intermediate certificate.

Re: Announcing the first SHA-1 collision

#270

Post by Ajedi32 »

SamBam wrote: post #190

I'm confused by the "File Tester" at https://shattered.it/ It says "Upload any file to test if they are part of a collision attack." When I upload either of their two sample collision documents, it says they are "Safe."

For me it says "Collision found in shattered-1.pdf"
Post reply on HN