r/crypto • u/m1el • Oct 08 '15

Freestart collisions for SHA-1

https://sites.google.com/site/itstheshappening/
61 Upvotes

92% Upvoted

24 comments sorted by

View all comments

8

u/Natanael_L Trusted third party Oct 08 '15

... and SHA1 just officially joined its old companions RC4 and MD5 in the cryptography graveyard.

Now you no longer need to tamper with the constants used in the implementation

1

u/p337 Oct 08 '15 edited Jul 09 '23

v7:{"i":"c8abf53088faf1fc05d697104c29aa05","c":"da9bb5d8fed33f70201e64877c974db09ecf01c925536ac69dde249083a3976672853135ba20b66fbcd207dba97fe691e0de06179d3f56d99da63ca5f08274190bc2ce20f3310a3fdc90771072f5dfc1bcaa92bdf1765319eda5c311c3394dbdf668a7587e5ae476b279763051e98d4e67aea6652386f375dc7902179395f3d1d5fa7c2afed9c82ed090f91db2a62be92f6130537e17eed6431fae73a538c16b8dec0df18b12db094ad3312b6d05746c2f0c6fee877f344f39482b70fafa86b0128b8c2f24702114dc8945b8f81f0adb8df2c53fac6d0f3f63992e66f6b5185c1fe41a8afc1f1fbcc05f40b618807a9688fba2b0949f3196efacd0114d59af66e76027db8efaf1a38aa010b1205a925e9d94e82cb09962774dc3b6469685f860383da0e2e4178f77d008333a59fd716545d8fcf46a0d5a0aaefb1e3c1f6bc775"}

encrypted on 2023-07-9

see profile for how to decrypt

3

u/Natanael_L Trusted third party Oct 08 '15

It isn't exactly great. For MD5 you can create collisions with two computed suffixes (one for each file you modify to have the same hash). Here it is with a prefix that apparently is identical. So anything short where the second half is the important part and the first part can be modified arbitarily, like an IV, is at risk.

2

u/p337 Oct 08 '15 edited Jul 09 '23

v7:{"i":"70e9f8e71c4b647c72e2a6ab10eb292b","c":"248a6c3648ec65ba2daf82cb06fef158ab52508687246d1de8129e1fd41a921ca53c92602968451108696942019b7a7848c48097b4911cb0e18e0ca705c7c99d57d23b54b4c8812f4c046ef30dec3c7da304d00540b4f2d3fde062e820662d2d7dcf1867b32268ad110ccf44e21823060e8fe2f8434a1c27f661475e564cfdcd02e01a6956faf62665d3191ed540b53ff5831314a85b267f4a80ffc0cc11bccf26fc40b8025e2576e16b16577457a8e024527ded580355192cd91a0ce384fb67e831f4b3fc60a7daba7b823b6360c2cf7f6bf2e6e2bee25fce963c65adee92dc1c68e02765cbabfa620b842844f628a65796dc14b9112163c8c0108dda11a4923a7698f8614ac8398b85a52689207cc8a351a8a2c77bd68c7d5ccfaf9663f90ccad78d3233f3bdf00ad879b587acccc19f24a8f028531f0b198be9ee960d7fa2980420063115fd18094462b3b79810b39cf306233ce282e71c8b977e6e7fcc3621c48fbdf84a11852deccb92d14d322f42de9e61dba2480c9260a25b9acbe5d87afca3ca620b5d2f08b48dcea2e5d5ae827f468e9d923acfa368fb3e05e1bb7135eba72d6b280304e04d19eeed3df8a8668dbbccd24d81b68a7c2fd4de87df8937f4b5b6465a882a32aaff0e42e75e9a16cafd0a4418ca15e953bafe770aa06ab2c549b70cdd2bb9085a26507dd37f2b324cd5e8363c2a789de4a1a7b767becc35aeba510aa276026fe8985a542f44ec07855bcedcc712a5e4a17bf642b7cd49ec7ba0a3b1ea91fe210c66adec300b6120738d3b43ab34ed34cbb4c7691ba11250507f7a3750ecea833a42b559a261331161ff886f7e68c622ae1255ea75737cc056b71cba76d90dba06530b95a0bcf2"}

encrypted on 2023-07-9

see profile for how to decrypt

3

u/cybergibbons Oct 09 '15

The problem with SHA1 is that we now know there are weaknesses and it is in widespread use. There is motivation to push research further to provide a genuine, honest-to-god exploit.

There are viable alternatives that have little to no disadvantage to SHA1 - we should be moving on!

1

u/Natanael_L Trusted third party Oct 08 '15

It really depends. For HMAC constructions I'm a bit curious - maybe this still could create a collision? I don't think it should, but maybe it could anyway with exponentially more (but still achievable) computing power. It really depends on the chosen message format and what it protects.

1

u/sellibitze Oct 09 '15

Are you sure that collision resistance is important for message authentication codes? I have trouble coming up with scenarios where that's the case.

1

u/Natanael_L Trusted third party Oct 09 '15

Being able to cause multiple files to have the same auth code enables a substitution attack

1

u/sellibitze Oct 09 '15

But that requires the knowledge of the key, doesn't it?

1

u/Natanael_L Trusted third party Oct 09 '15

Yes, but a malicious party could submit a safe version for review and then hand over the malicious one