The first chosen-prefix collision for SHA-1 • Hacker News Board

Re: The first chosen-prefix collision for SHA-1

#111

Post by rectang » Tue, Jan 07, 2020, 4:50 PM UTC

shilch wrote: post #98

mehrdadn wrote: post #84

> SHA-1 has been broken for 15 years, so there is no good reason to use this hash function in modern security software. Why are cryptographers always exaggerating things and so out of touch with reality? The first actual collision was like 3 years ago. It's not like the world has been on fire in the meantime, and it's not like SHA-1 is broken for every single possible usage even now. And why the nonsense with "no goo…

Like computer scientist, they think binary: Either it's secure, or it's not. In reality there's a spectrum where you also have "good enough".

The security strategy with the most practical utility for most software engineers working on most projects is defense in depth: multiple layers, each assumed to be breakable.

It's a striking contrast with the stark mathematical language deployed by cryptographers, on whose work we rely.

If we differentiate between the two fields of software engineering and cryptography, it's easier to be generous in our appreciation for the different goals and mental models.

Re: The first chosen-prefix collision for SHA-1

#112

Post by ReidZB » Tue, Jan 07, 2020, 4:53 PM UTC

dweekly wrote: post #103

PeterisP wrote: post #97

Earlier quoted context omitted.

Past experience and documents that ceased being classified shows that serious attackers (e.g. NSA) are at least decade ahead of what's publicly known in cryptography; i.e. we know that pretty much always when new relevant groundbreaking math was published, the classified cryptographers had known that for a long, long time already. So if this attack is developed today, then you should assume that NSA has been able to…

Are there materials that show a ten year head start?

I think there's skepticism in the community that NSA et al actually have such a far head-start now.

That said, historically speaking, back in the early 70s DES was being designed. The NSA made some unjustified changes to its S-boxes. At the time, there were allegations that they had made them intentionally weaker. (Or so I've read; I wasn't born yet.) In the early 90s, differential cryptanalysis was discovered for the first time, and it turns out that DES was already resistant to it (unlike other block ciphers at the time): in fact, the NSA already knew about differential cryptanalysis, 20 years ahead of the general public, and intentionally strengthened DES. (Also, IBM discovered it, too, but kept it quiet at the NSA's request.)

Re: The first chosen-prefix collision for SHA-1

#113

Post by ApolloFortyNine » Tue, Jan 07, 2020, 4:54 PM UTC

mehrdadn wrote: post #84

> SHA-1 has been broken for 15 years, so there is no good reason to use this hash function in modern security software. Why are cryptographers always exaggerating things and so out of touch with reality? The first actual collision was like 3 years ago. It's not like the world has been on fire in the meantime, and it's not like SHA-1 is broken for every single possible usage even now. And why the nonsense with "no goo…

For anything requiring fast hashing performance today, is there a reason why Blake2 [1] wouldn't be chosen? It seems to be faster than SHA1 and uses a similar algorithm as SHA3. As collisions become easier to create I would think it'd cause a problem in many even insecure use cases. I'm pretty sure github had to blacklist those two pdfs that originally had the same hash.

[1] https://blake2.net/

Re: The first chosen-prefix collision for SHA-1

#114

Post by PeterisP » Tue, Jan 07, 2020, 4:55 PM UTC

dweekly wrote: post #103

PeterisP wrote: post #97

Earlier quoted context omitted.

Past experience and documents that ceased being classified shows that serious attackers (e.g. NSA) are at least decade ahead of what's publicly known in cryptography; i.e. we know that pretty much always when new relevant groundbreaking math was published, the classified cryptographers had known that for a long, long time already. So if this attack is developed today, then you should assume that NSA has been able to…

Are there materials that show a ten year head start?

For an early example, differential cryptanalysis methods were 'discovered' in late 1980s by Biham and Shamir; but it later turned out that resistance to it was pushed as a design consideration already back in 1974 when DES was designed, so NSA knew of it at least then, that's more than a decade.

We know that British intelligence (who don't have as much resources as NSA) had developed the RSA equivalent something like 5 years before Rivest/Shamir/Adleman got to it; and we still have no idea how far NSA was with that math at the time - all we have is circumstancial evidence such as travel reports of NSA representatives going to cryptography conferences and being satisfied that absolutely no math that's new (to them) or even potentially leading to something new was being revealed there.

We also have NSA suddenly changing recommendations to use/stop using certain cryptosystems that still doesn't make sufficient sense - e.g. the 2015 turning away from 'suite B' ECC may have been due to some quantum discovery as is claimed, or some other weakness being found, but it's been five years and we (as far as I understand) still don't know as much as they did back in 2015, so they're more than 5 years ahead. But to know whether the current advantage is ten years or more or less, we'll have to wait a generation or so, it takes a long time for truth to leak.

Re: The first chosen-prefix collision for SHA-1

#115

Post by HashThis » Tue, Jan 07, 2020, 4:55 PM UTC

Quick, everyone bend over and cover your hashes

Re: The first chosen-prefix collision for SHA-1

#116

Post by lmilcin » Tue, Jan 07, 2020, 4:56 PM UTC

mehrdadn wrote: post #84

> SHA-1 has been broken for 15 years, so there is no good reason to use this hash function in modern security software. Why are cryptographers always exaggerating things and so out of touch with reality? The first actual collision was like 3 years ago. It's not like the world has been on fire in the meantime, and it's not like SHA-1 is broken for every single possible usage even now. And why the nonsense with "no goo…

The difference it was "a" collision. Now, that wasn't very helpful if you wanted to forge a document.

This is chosen prefix collision. This means you can select a beginning of a document which in many cases is enough.

Re: The first chosen-prefix collision for SHA-1

#117

Post by Ajedi32 » Tue, Jan 07, 2020, 5:04 PM UTC

timdumol wrote: post #71

colanderman wrote: post #69

Earlier quoted context omitted.

I'm super confused. Are SHA-256 and SHA256 different , and if so, why in the world would this be considered a sane naming scheme? If not, I completely do not understand the inequation you wrote, which seemingly lists SHA-256 (and -512) multiple times.

You're probably confused by "SHA-512/256", which does not mean SHA-512 or 256, but rather a truncated version of SHA-512: https://en.wikipedia.org/wiki/SHA-2 in the third paragraph.

So why would a truncated version of SHA-512 be better than SHA-512? And why is SHA-512 = SHA-256?

Re: The first chosen-prefix collision for SHA-1

#118

Post by rst » Tue, Jan 07, 2020, 5:04 PM UTC

jlokier wrote: post #102

Just a curiosity, since people are talking about Git still using SHA-1 (despite work on SHA-256 since 2017). I see that Git doesn't actually use SHA-1 any more, it uses "hardened SHA-1": https://stackoverflow.com/questions/10434326/hash-collision-...

Well, according to that reference, it's hardened against a specific, previously known attack. Do you have any information on whether that also protects against the different, new attack which was just published?

Re: The first chosen-prefix collision for SHA-1

#119

Post by gpm » Tue, Jan 07, 2020, 5:06 PM UTC

riquito wrote: post #87

LadyCailin wrote: post #82

Earlier quoted context omitted.

If you use SHA-256 to encrypt your backup, then I just need to steal your backup and wait 20 years, until that is cracked, and then I can decrypt your backup, even though today you’re using the “correct” encryption.

The GP was likely hinting at SHA1 being an hashing function, non an encryption function, so just applying sha* wouldn't produce a working backup

It probably will if your data is less than 128 bytes, and you're willing to wait a few decades to decrypt it.

Re: The first chosen-prefix collision for SHA-1

#120

Post by brink » Tue, Jan 07, 2020, 5:09 PM UTC

shilch wrote: post #98

mehrdadn wrote: post #84

> SHA-1 has been broken for 15 years, so there is no good reason to use this hash function in modern security software. Why are cryptographers always exaggerating things and so out of touch with reality? The first actual collision was like 3 years ago. It's not like the world has been on fire in the meantime, and it's not like SHA-1 is broken for every single possible usage even now. And why the nonsense with "no goo…

Like computer scientist, they think binary: Either it's secure, or it's not. In reality there's a spectrum where you also have "good enough".

Most people think in yes/no logic. Unfortunately binary is a horrible oversimplification of a very analog reality and results in many of the world's problems that we're in now. Because we tend to think of a binary of yes/no, we often end up flying from one ditch on the side of the road to the other.