Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A SHA-1 chosen-prefix collision attack

zdnet.com

Post reply on HN
Print view View original

71–75 of 75 posts

Re: A SHA-1 chosen-prefix collision attack

#71

Post by orblivion »

orblivion wrote: post #33
evv wrote: post #26

Can collision attacks provide the same size of data? I suspect it would be dramatically more difficult to produce a collision of equal data-size as the original. So perhaps, the easiest way to defend against a collision attack is to transmit the size of the data alongside the checksum. Like a checksum, it is extremely lightweight and easy to check. In my data framework project (where I use sha1 to identify blocks), I…

For what it's worth, Shattered specifically altered a small part of an existing file. Perhaps with chosen-prefix the story is different. https://shattered.io (check out the two pdfs)

I forgot to specifically state - I think the two pdfs are the same size.

Re: A SHA-1 chosen-prefix collision attack

#72

Post by wiml »

foobiekr wrote: post #43
anderskaseorg wrote: post #29

“Everyone should switch to (in order of preference): • BLAKE2b / BLAKE2s • SHA-512/256 • …” You know, SHA-512/256 was a terrible name. For someone who’s not a cryptographer, it’s way too easy to confuse the single algorithm SHA-512/256, which resists length extension attacks, with the pair of algorithms SHA-512 / SHA-256, which do not.

"truncated sha512" would be a much better way to talk about it.

It isn't exactly truncated SHA-512 — that is, you can't compute a SHA-512/256 hash by computing a SHA-512 hash and then truncating it. Although the algorithm is the same as doing that, the initial state of the hash context is different.

(The same is true for SHA-224, which could be called SHA-256/224; it's a truncated SHA-256, but with a different internal state.)

Re: A SHA-1 chosen-prefix collision attack

#73

Post by orblivion »

jwilk wrote: post #62
evv wrote: post #26

Can collision attacks provide the same size of data? I suspect it would be dramatically more difficult to produce a collision of equal data-size as the original. So perhaps, the easiest way to defend against a collision attack is to transmit the size of the data alongside the checksum. Like a checksum, it is extremely lightweight and easy to check. In my data framework project (where I use sha1 to identify blocks), I…

(This is chosen-prefix attack; there is no "the original".) In all the attacks on MD5 or SHA-1 I'm aware of, the generated colliding strings had the same length.

So Shattered was "give me two different documents with the same sha1, I don't care what they are". I guess according to Wikipedia that's a "classical" collision.

Then there's "here's two different documents. Append to both of them until the results have the same hash". This is "chosen prefix" collision.

My question is, is there a name for an attack that says "here's a document. give me another document with the same hash."? (in which case, "the original" would have meaning).

Re: A SHA-1 chosen-prefix collision attack

#74

Post by foobiekr »

wiml wrote: post #72
foobiekr wrote: post #43

Earlier quoted context omitted.

"truncated sha512" would be a much better way to talk about it.

It isn't exactly truncated SHA-512 — that is, you can't compute a SHA-512/256 hash by computing a SHA-512 hash and then truncating it. Although the algorithm is the same as doing that, the initial state of the hash context is different. (The same is true for SHA-224, which could be called SHA-256/224; it's a truncated SHA-256, but with a different internal state.)

True, that’s a good point.

Re: A SHA-1 chosen-prefix collision attack

#75

Post by jwilk »

orblivion wrote: post #73
jwilk wrote: post #62

Earlier quoted context omitted.

(This is chosen-prefix attack; there is no "the original".) In all the attacks on MD5 or SHA-1 I'm aware of, the generated colliding strings had the same length.

So Shattered was "give me two different documents with the same sha1, I don't care what they are". I guess according to Wikipedia that's a "classical" collision. Then there's "here's two different documents. Append to both of them until the results have the same hash". This is "chosen prefix" collision. My question is, is there a name for an attack that says "here's a document. give me another document with the same…

It's called "second preimage attack".
Post reply on HN