Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The first chosen-prefix collision for SHA-1

sha-mbles.github.io

Post reply on HN
Print view View original

21–30 of 369 posts

Re: The first chosen-prefix collision for SHA-1

#21

Post by paulddraper »

wyldfire wrote: post #19
groovybits wrote: post #10

Earlier quoted context omitted.

Further details as to why Torvalds is not concerned: From the email... "I haven't seen the attack yet, but git doesn't actually just hash the data, it does prepend a type/length field to it. That usually tends to make collision attacks much harder, because you either have to make the resulting size the same too, or you have to be able to also edit the size field in the header." [...] "I haven't seen the attack detail…

I think those are pretty practical approaches. But it sounds as if the cost of changing the hash algorithm is high. What are the impacts of this change? How many things would break if git just changed the algorithm with each new release? Does git assume that the hash algorithm is statically given to be SHA-1 or are there qualifiers on which algorithm is enabled/permitted/configured?

After making the actual code change, the biggest problem is breaking compatibility with decades of tools in the ecosystem that rely on historically consistent SHA-1 hashes.

Git is moving to a flexible hash though. [1]

[1] https://stackoverflow.com/questions/28159071/why-doesnt-git-...

Re: The first chosen-prefix collision for SHA-1

#23

Post by est31 »

groovybits wrote: post #10
rkangel wrote: post #6

Earlier quoted context omitted.

It adds to the weight of the argument, but there isn't a big issue. This article ( https://www.zdnet.com/article/linus-torvalds-on-sha-1-and-gi... ) and the linked email ( https://marc.info/?l=git&m=148787047422954 ) both seem to still apply.

Further details as to why Torvalds is not concerned: From the email... "I haven't seen the attack yet, but git doesn't actually just hash the data, it does prepend a type/length field to it. That usually tends to make collision attacks much harder, because you either have to make the resulting size the same too, or you have to be able to also edit the size field in the header." [...] "I haven't seen the attack detail…

That first quote is misleading. git's special hashing scheme doesn't make the attack "much harder". First there is no difference in length in the original shattered collision already:

$ curl https://shattered.io/static/shattered-1.pdf | wc -c

422435

$ curl -s https://shattered.io/static/shattered-2.pdf | wc -c

422435

Second, the length is already being hashed into the content during computation of a SHA-1 hash. Look up Merkle-Damgard construction: https://en.wikipedia.org/wiki/Merkle%E2%80%93Damg%C3%A5rd_co...

There is benefit in storing the length at the prefix as well, as you can avoid length extension attacks, but that's not making attacks "much harder".

Re: The first chosen-prefix collision for SHA-1

#25

Post by oppositelock »

rustybolt wrote: post #22

> By renting a GPU cluster online, the entire chosen-prefix collision attack on SHA-1 costed us about 75k USD. So they just decided to try their attack and spend two years worth of salary on it?? That's crazy.

That's dirt cheap for a government actor, and we can be sure that the big governments have been doing this sort of attack for years.

Re: The first chosen-prefix collision for SHA-1

#27

Post by exikyut »

rustybolt wrote: post #22

> By renting a GPU cluster online, the entire chosen-prefix collision attack on SHA-1 costed us about 75k USD. So they just decided to try their attack and spend two years worth of salary on it?? That's crazy.

No. It's incredibly generous and selfless. They threw that money away just to incontrovertibly prove a huge point to the entire security community (and all developers, at the end of the day).

Like... chaotic good. Really really good.

Re: The first chosen-prefix collision for SHA-1

#28

Post by rustybolt »

oppositelock wrote: post #25
rustybolt wrote: post #22

> By renting a GPU cluster online, the entire chosen-prefix collision attack on SHA-1 costed us about 75k USD. So they just decided to try their attack and spend two years worth of salary on it?? That's crazy.

That's dirt cheap for a government actor, and we can be sure that the big governments have been doing this sort of attack for years.

It's a lot of money for an academic researcher.

Re: The first chosen-prefix collision for SHA-1

#29

Post by martpie »

rustybolt wrote: post #22

> By renting a GPU cluster online, the entire chosen-prefix collision attack on SHA-1 costed us about 75k USD. So they just decided to try their attack and spend two years worth of salary on it?? That's crazy.

You can see their emails at the bottom: those are universities/research institutes domains. You can be sure _they_ did not actually spend that themselves.
Post reply on HN