61–70 of 86 posts
I looked into citation [5] since it sounded interesting but the DOI link has been hallucinated and goes to some other article. I assume many of the others are similarly bogus.
> Secure hash functions are used to make a short version of a large file. Ideally, it has several properties including making it infeasible to find two files with the same cryptographic hash. We've just gotten 92% of the way there. This has security ramifications in that other researchers are expected to be able to complete the work through similar methods as explored in the paper. We weren't sure if this was a remar…
Thank you for pointing out that that section could be clearer. I've now updated it. It now reads: >We've just gotten 92% of the way to finding a single collision (this means that there is no full collision yet.). This has security ramifications in that other researchers are expected to be able to complete the work through similar methods as explored in the paper, and eventually produce collisions at will. We weren't…
I looked into citation [5] since it sounded interesting but the DOI link has been hallucinated and goes to some other article. I assume many of the others are similarly bogus.
Fixed, thank you and my apologies for the oversight. The titles were accurate and we consulted those works in preparing this work.
Earlier quoted context omitted.
Thank you for pointing out that that section could be clearer. I've now updated it. It now reads: >We've just gotten 92% of the way to finding a single collision (this means that there is no full collision yet.). This has security ramifications in that other researchers are expected to be able to complete the work through similar methods as explored in the paper, and eventually produce collisions at will. We weren't…
Well, try sha2-224. It’s 87% of the way to sha2-256. /s
For a shorter executive summary, what does "broke" mean here? Can you reliably produce collisions now for 92% of SHA-256 digests?
No, or we would have said so. It means that by relaxing the equations schedule somewhat, we are able to find a pair of differing messages that produce the same digest. However, we only relax the schedule a little bit, we still enforce 59 out of 64 schedule equations through the full 64 rounds - which is why we're only 92% of the way through to breaking it and not 100% of the way as we are with MD5. Importantly, we ar…
Earlier quoted context omitted.
No, or we would have said so. It means that by relaxing the equations schedule somewhat, we are able to find a pair of differing messages that produce the same digest. However, we only relax the schedule a little bit, we still enforce 59 out of 64 schedule equations through the full 64 rounds - which is why we're only 92% of the way through to breaking it and not 100% of the way as we are with MD5. Importantly, we ar…
I don't believe a word of this.
Long time reader first time poster here... What is the verdict (humans)? AI slop research or modern cryptography (and society) flushed down the toilet overnight? I can't immediately tell from the thread so far... :)
Sorry, there’s not much of a way I can say that more politely and still accurately convey my opinion.
In the linked work, we've broken 92% of SHA-256 across its full 64 rounds, and were encouraged to publish it by the leading cryptographer in the field (who held the previous record). Currently, SHA-256 is the basis of TLS certificates, bitcoin, and many other security applications. We think it is time to begin to migrate to other hash families, because we expect the rest of SHA-256 to fall soon.
I believe I hold the actual record for most colliding bits in full-round SHA256 (72% of bits matching). My proof fits in a tweet, why doesn't yours? https://news.ycombinator.com/item?id=38668893 (Also my work does not demonstrate any weakness in SHA256, it's just an application of the birthday paradox)
Since you've made hashes that match at the beginning and end, you might also be interested in our exploration of alternative presentation formats that make attacks like this a little bit more difficult. We were working on a new hash and thought about how to assist people visually at the presentation level. This one tests your speed versus a typical hex presentation.[1]
[1] https://claude.ai/public/artifacts/05e8b21b-fb31-4c07-83e2-5...
Earlier quoted context omitted.
Thank you for pointing out that that section could be clearer. I've now updated it. It now reads: >We've just gotten 92% of the way to finding a single collision (this means that there is no full collision yet.). This has security ramifications in that other researchers are expected to be able to complete the work through similar methods as explored in the paper, and eventually produce collisions at will. We weren't…
What does "92% of the way" mean? 92% of what? How is that percentage measured?