A SHA-1 chosen-prefix collision attack

Nope. SHA-2 (known to developers as SHA224, SHA256, SHA384, and SHA512) was the replacement for SHA-1. SHA-3 was created as an insurance policy in case the SHA-2 family was broken too. So far, it hasn't been.

We won't need a SHA-4 any time soon. SHA-2 is fine, BLAKE2 is fine (and faster), SHA-3 is fine.

Re: A SHA-1 chosen-prefix collision attack

#6

Post by asdfv09s9d80fu9 » Tue, May 14, 2019, 6:31 PM UTC

CiPHPerCoder wrote: post #5

ChrisSD wrote: post #3

It must be about time for SHA-4.

Nope. SHA-2 (known to developers as SHA224, SHA256, SHA384, and SHA512) was the replacement for SHA-1. SHA-3 was created as an insurance policy in case the SHA-2 family was broken too. So far, it hasn't been. We won't need a SHA-4 any time soon. SHA-2 is fine, BLAKE2 is fine (and faster), SHA-3 is fine.

Nice try, NSA!

Re: A SHA-1 chosen-prefix collision attack

#7

Post by zdw » Tue, May 14, 2019, 6:39 PM UTC

From the paper, this doesn't seem to be able to create a collision while retaining the same length of input data.

It seems that checking both the hash and input length would be a very cheap way of identifying attempts at hash collisions.

Re: A SHA-1 chosen-prefix collision attack

#8

Post by optimiz3 » Tue, May 14, 2019, 6:42 PM UTC

CiPHPerCoder wrote: post #5

ChrisSD wrote: post #3

It must be about time for SHA-4.

Nope. SHA-2 (known to developers as SHA224, SHA256, SHA384, and SHA512) was the replacement for SHA-1. SHA-3 was created as an insurance policy in case the SHA-2 family was broken too. So far, it hasn't been. We won't need a SHA-4 any time soon. SHA-2 is fine, BLAKE2 is fine (and faster), SHA-3 is fine.

Also, SHA-2 underpins Bitcoin; it's the ultimate billion dollar pot of gold. SHA-2 is perhaps the most exhaustively researched (both publicly and privately) cryptographic hash because of this.

Re: A SHA-1 chosen-prefix collision attack

#9

Post by arkadiyt » Tue, May 14, 2019, 6:51 PM UTC

Their attacks are based on previous chosen-prefix work from Marc Stevens, who tweeted this about the attack [1]:

"Their $100K figure is based on as-of-yet undisclosed improvements. History shows many claims of low-cost SHA-1 attacks that have not stood up to peer review. I am very sceptical that their attack costs in total less than the $110K building block (SHAttered) that they use."

[1]: https://twitter.com/realhashbreaker/status/11282604227868549...

Re: A SHA-1 chosen-prefix collision attack

#10

Post by chrisseaton » Tue, May 14, 2019, 6:56 PM UTC

zdw wrote: post #7

From the paper, this doesn't seem to be able to create a collision while retaining the same length of input data. It seems that checking both the hash and input length would be a very cheap way of identifying attempts at hash collisions.

If you're going to modify your code to add an extra check you might as well just switch to another algorithm entirely.