The first chosen-prefix collision for SHA-1 • Hacker News Board

Re: The first chosen-prefix collision for SHA-1

#91

Post by CiPHPerCoder » Tue, Jan 07, 2020, 4:25 PM UTC

fireflash38 wrote: post #62

CiPHPerCoder wrote: post #15

Earlier quoted context omitted.

SHA-256 and SHA-512 are both in the same family (SHA-2). Latacora says to use SHA-2. If you can get away with it, SHA-512/256 instead of SHA-256. But they're all SHA-2 family hash functions. https://latacora.micro.blog/2018/04/03/cryptographic-right-a... No need to bikeshed this. But if you must: SHA-512/256 > SHA-384 > SHA-512 = SHA-256 If you're wondering, "Why is SHA-384 better than SHA-512 and SHA-256?" the answe…

I read the blog, but it doesn't really expand on why SHA224/384 aren't vulnerable to that attack, can you explain (or link to some place that does?)

Because they're already truncated.

SHA-384 is SHA-512 with a different IV (which doesn't affect LEAs) truncated to 384 bits (which gives you 128 bits of resistance against LEAs).

SHA-224 is the same story but with SHA-256 instead (and only 32 bits of LEA resistance).

Re: The first chosen-prefix collision for SHA-1

#92

Post by kps » Tue, Jan 07, 2020, 4:27 PM UTC

School-Cotton wrote: post #68

simias wrote: post #49

Earlier quoted context omitted.

And the linked article showed you that, in practice, "a shambles" is perfectly correct English. It is therefore correct in a descriptivist sense. Beyond that prefixing your comment by "downvoted" is frankly silly and only serves to derail the conversation IMO.

"a shambles" is not used (or quite rarely used) in North America, in my experience. Which was what the OP was asking about. You are of course right that "a shambles" is perfectly fine British English, but that's beside the point.

I'm in North America and have never heard ‘in shambles’, without ‘a’. If I did, I'd probably take it as uneducated sociolect.

Re: The first chosen-prefix collision for SHA-1

#93

Post by mlurp » Tue, Jan 07, 2020, 4:29 PM UTC

tambourine_man wrote: post #76

This kind of thing always brings me down a bit. It's not rational, but it does. I mean I truly admire these folks skills, the math involved is obviously remarkable. But I think the feeling is related to not being able to rely on anything in our field. Hard to justify going to the trouble of encrypting your backup. 10 years from now, it might be as good as plain text. It's not security only, nothing seems to work in t…

This can really apply to almost everything though, since if I understand you, it seems to be about progress in the face impermanence. The history of science is basically a constant process of things kind of working, then breaking. But overall it goes forward and things are better off for it. In contrast, I find it kind of inspiring.

Re: The first chosen-prefix collision for SHA-1

#94

Post by CiPHPerCoder » Tue, Jan 07, 2020, 4:30 PM UTC

notlukesky wrote: post #70

> Responsible Disclosure We have tried to contact the authors of affected software before announcing this attack, but due to limited resources, we could not notify everyone. Is there a list of affected software out there?

https://github.com/search?q=sha1&type=Code https://github.com/search?q=sha-1&type=Code

Re: The first chosen-prefix collision for SHA-1

#95

Post by PeterisP » Tue, Jan 07, 2020, 4:30 PM UTC

harikb wrote: post #89

wyday wrote: post #80

Earlier quoted context omitted.

>> "Hard to justify going to the trouble of encrypting your backup." Huh? If you're "encrypting" using SHA, I've got some bad news about those backups of yours.

I think GP was taking about the general nature of “previously assumed to be unbreakable” methods being broken. Not sure if he has implying using a checksum also for encryption

What do you mean by "previously assumed to be unbreakable" ? SHA-1 has been known to be unsafe for a dozen years, we just went from "assumed to be breakable" to "yep, definitely breakable, here's how one exact attack will work".

Re: The first chosen-prefix collision for SHA-1

#96

Post by ewidar » Tue, Jan 07, 2020, 4:34 PM UTC

mehrdadn wrote: post #84

> SHA-1 has been broken for 15 years, so there is no good reason to use this hash function in modern security software. Why are cryptographers always exaggerating things and so out of touch with reality? The first actual collision was like 3 years ago. It's not like the world has been on fire in the meantime, and it's not like SHA-1 is broken for every single possible usage even now. And why the nonsense with "no goo…

As stated, they are talking about "modern security software".

So yeah, if you are building/improving software that has a clear focus on security, you should use a secure hash. Seems only natural to me.

Re: The first chosen-prefix collision for SHA-1

#97

Post by PeterisP » Tue, Jan 07, 2020, 4:35 PM UTC

mehrdadn wrote: post #84

> SHA-1 has been broken for 15 years, so there is no good reason to use this hash function in modern security software. Why are cryptographers always exaggerating things and so out of touch with reality? The first actual collision was like 3 years ago. It's not like the world has been on fire in the meantime, and it's not like SHA-1 is broken for every single possible usage even now. And why the nonsense with "no goo…

Past experience and documents that ceased being classified shows that serious attackers (e.g. NSA) are at least decade ahead of what's publicly known in cryptography; i.e. we know that pretty much always when new relevant groundbreaking math was published, the classified cryptographers had known that for a long, long time already.

So if this attack is developed today, then you should assume that NSA has been able to execute this attack for at least ten years already whenever it suited them, including mass surveilance of random not-that-important people. The same applies for the collisions - the first published collision was 3 years ago, but we should assume that that's definitely not the first; I mean, only a minority of the world's cryptography researchers participate in the public, open, academic community; the majority of them are employed with a condition that they won't get to publish anything important. And since we know for the last ten years that such attacks were possible, there's no reasonable reason why SHA-1 would have been considered as safe.

Re: The first chosen-prefix collision for SHA-1

#98

Post by shilch » Tue, Jan 07, 2020, 4:36 PM UTC

mehrdadn wrote: post #84

> SHA-1 has been broken for 15 years, so there is no good reason to use this hash function in modern security software. Why are cryptographers always exaggerating things and so out of touch with reality? The first actual collision was like 3 years ago. It's not like the world has been on fire in the meantime, and it's not like SHA-1 is broken for every single possible usage even now. And why the nonsense with "no goo…

Like computer scientist, they think binary: Either it's secure, or it's not. In reality there's a spectrum where you also have "good enough".

Re: The first chosen-prefix collision for SHA-1

#99

Post by espadrine » Tue, Jan 07, 2020, 4:37 PM UTC

mehrdadn wrote: post #84

> SHA-1 has been broken for 15 years, so there is no good reason to use this hash function in modern security software. Why are cryptographers always exaggerating things and so out of touch with reality? The first actual collision was like 3 years ago. It's not like the world has been on fire in the meantime, and it's not like SHA-1 is broken for every single possible usage even now. And why the nonsense with "no goo…

Cryptographers rely on precise definitions to make their assessments.

In particular, a primitive makes a number of useful promises. Any achievement that describes a way in which a promise is not kept makes that primitive broken, regardless of whether that achievement is theoretical or practical.

(They often talk about “theoretically broken” or “practically broken” to distinguish whether it was actually done.)

> it's not like SHA-1 is broken for every single possible usage

True, but it is extremely easy to believe your usage is unbroken and be wrong. Besides, often, primitives that are broken for one usage eventually break for others.

> why the nonsense with "no good reason"? Obviously performance is one significant consideration for the unbroken use cases

There are many much more robust primitives with better performance nowadays, such as BLAKE2, SHA-512/256, or Kangaroo12.

Re: The first chosen-prefix collision for SHA-1

#100

Post by remus » Tue, Jan 07, 2020, 4:38 PM UTC

mehrdadn wrote: post #84

> SHA-1 has been broken for 15 years, so there is no good reason to use this hash function in modern security software. Why are cryptographers always exaggerating things and so out of touch with reality? The first actual collision was like 3 years ago. It's not like the world has been on fire in the meantime, and it's not like SHA-1 is broken for every single possible usage even now. And why the nonsense with "no goo…

Depreciating things takes a long time. It could be 10 years before 'that guy' in your office gets it in to his head that SHA-1 isn't appropriate where security is concerned. Thus you want to make it unambiguous that now is a good time to move to something else so that when it is thoroughly broken in 10 years time you're minimising the number of people who have yet to switch.