Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We broke 92% of SHA-256 – you should start to migrate from it

stateofutopia.com

Post reply on HN
Print view View original

41–50 of 86 posts

Re: We broke 92% of SHA-256 – you should start to migrate from it

#41

Post by skeledrew »

jrexilius wrote: post #18
pavel_lishin wrote: post #7

> Secure hash functions are used to make a short version of a large file. Ideally, it has several properties including making it infeasible to find two files with the same cryptographic hash. We've just gotten 92% of the way there. This has security ramifications in that other researchers are expected to be able to complete the work through similar methods as explored in the paper. We weren't sure if this was a remar…

Is a partial collision an indicator that it could be broken? The "we broke it" seems an exageration, but maybe that's a failure of my understanding.

Possible. It's up to people to decide if they're OK with a known 92% collision out there (with the unknown being there could be a 100%), or go for something stronger.

Re: We broke 92% of SHA-256 – you should start to migrate from it

#42

Post by Retr0id »

logicallee wrote: post #35
mkeeter wrote: post #13

The "Intermediate Report" [1] lists the authors as "Robert V. and Claude (Anthropic)". Is there any reason to believe this is not AI hallucinations? [1] https://stateofutopia.com/papers/2/intermediate-report.pdf

[flagged]

If you can't tell the difference between MD5 and SHA-256, you should not be making claims such as the one in the title.

Re: We broke 92% of SHA-256 – you should start to migrate from it

#43

Post by Retr0id »

drum55 wrote: post #19

> it is possible that we'll find relations that carry across the entire double-SHA-256 pipeline Bitcoin mining is a partial second preimage of 0x00 though, not a collision, that statement just seems to be so outside the realm of what they’re claiming to have done. Even MD5, the most widely known to be broken hash, would be secure when used in the same way bitcoin uses SHA256 (other than being too short now, bitcoin m…

Also, a collision on single-sha256 would imply a collision of double-sha256 right off the bat, since the inputs to the second round would be matching. But as you say, a collision attack doesn't do much to BTC mining.

Re: We broke 92% of SHA-256 – you should start to migrate from it

#44

Post by logicallee »

bhouston wrote: post #9
jimjeffers wrote: post #5

Is this real? The website does not look credible.

This hn post is made by author of the paper. It needs even a tiny bit of peer review.

Yes, I'm the author of the paper. It's received more than a tiny bit of peer review. I'm happy to answer any questions about it or answer anything that is unclear.

Re: We broke 92% of SHA-256 – you should start to migrate from it

#45

Post by thenewnewguy »

logicallee wrote: post #38
pavel_lishin wrote: post #7

> Secure hash functions are used to make a short version of a large file. Ideally, it has several properties including making it infeasible to find two files with the same cryptographic hash. We've just gotten 92% of the way there. This has security ramifications in that other researchers are expected to be able to complete the work through similar methods as explored in the paper. We weren't sure if this was a remar…

Thank you for pointing out that that section could be clearer. I've now updated it. It now reads: >We've just gotten 92% of the way to finding a single collision (this means that there is no full collision yet.). This has security ramifications in that other researchers are expected to be able to complete the work through similar methods as explored in the paper, and eventually produce collisions at will. We weren't…

What does "92% of the way" mean? 92% of what? How is that percentage measured?

Re: We broke 92% of SHA-256 – you should start to migrate from it

#46

Post by Retr0id »

logicallee wrote: post #44
bhouston wrote: post #9

Earlier quoted context omitted.

This hn post is made by author of the paper. It needs even a tiny bit of peer review.

Yes, I'm the author of the paper. It's received more than a tiny bit of peer review. I'm happy to answer any questions about it or answer anything that is unclear.

By which peers?

Re: We broke 92% of SHA-256 – you should start to migrate from it

#47

Post by logicallee »

bem94 wrote: post #24

I'd expect a finding / paper like this to be submitted to the IACR ePrint server [1] to bring it to the attention of the cryptographic community. I can't see that it's been submitted yet. Venue should not imply credibility but in this case it would certainly help bring the proper scrutiny. [1] https://eprint.iacr.org/

You can verify the certificates yourself or just wait for us to make an end-to-end collision generator as we did for MD5[1] - you can use that to generate a collision in seconds on your phone or any computer. If you wait for us to complete the end to end collision, in a sense it will be a little too late as TLS certificates and other security that relies on SHA-256 needs time to move away. We think it's responsible to disclose at this stage, and as mentioned, our peer reviewer said it is a "very good result" that is "worth publishing". We've gone to great pains to make our method completely reproducible, even writing in the article that we'll help anyone who is having trouble with any part.

[1] https://stateofutopia.com/experiments/md5collider

Re: We broke 92% of SHA-256 – you should start to migrate from it

#50

Post by logicallee »

bob1029 wrote: post #15

The neat thing about bitcoin is that the incentive to break it is so high that it would almost certainly be the first place you would learn that SHA2 had been broken. Not on a website like this. I can verify its integrity by opening robinhood on my phone.

>The neat thing about bitcoin is that the incentive to break it is so high that it would almost certainly be the first place you would learn that SHA2 had been broken.

We actually see the incentive in the other direction, if we were able to reduce the search space for bitcoin proof-of-work (by applying thousands of higher-order algabraic theorems end-to-end to reduce the search space somewhat[1]), we would be financially incentivized not to tell anyone and mine at a discount. The financial incentive is against open research and disclosure. We don't get anything out of disclosing this except a neat publication.

[1] interestingly, ASICs (which are usually used to mine bitcoin) basically encode every operation verbatim, they don't use higher order mathematics at all. However, reducing mining complexity is not really on the horizon, even with our latest approaches, since it would require end-to-end complete control over the double-SHA-256 pipeline. That's considerably harder than just finding a collision when you're allowed to search just the tail part (the final rounds).

Post reply on HN