Hacker News Reader

Comment by simias | Hacker News Reader

It's not a particularly interesting email, I don't think it's bringing anything new on the table. The title also doesn't have anything to do with the contents (I understand that might be because of HN submission rules but it's very misleading in this case).

It's a bit hard to take the author seriously when he complains about "headless chickens" "considerably exaggerat[ing]" then goes on to say that you need "a nation-state's worth of resources" to find collisions. If anything this shattered proof of concept showed that it was actually a lot easier than that, giving an estimate of around 110k$ IIRC.

I'm also sure that SHA-1 remains pervasive in many codebases, although as long as pre-image are impractical it might be hard to exploit those vulnerabilities.

View on HN

>I'm also sure that SHA-1 remains pervasive in many codebases

I've done a lot of security reviews of backup solutions over the years and nearly universally they use SHA1 for de-duplication. Security professionals have been providing warnings about this practice, but when you are dealing with a cloud backup solution as an example, speed and low compute requirements are a must and it's hard to win the argument when someone tosses "theoretical" onto the table. Well, we are now past "theoretical" and that's what matters.

I just tried out the SHA1 collider: https://alf.nu/SHA1 and created two PDFs containing entirely different bits of text in JPGs. It took seconds and indeed the output of the files were SHA1 identical. This is no longer nation-state level stuff and computing colliding documents to upload to cloud backup providers who de-dupe across the file system and not just restricted within the boundaries of each account could result in the ability to wipe out and change other people's data. At a minimum that could be an annoyance. At worst, it could result in the intentional change of someone's content to cause significant financial or physical harm.

the two PDFs used the same (colliding) prefix and included both files you supplied. once you've reached a hash collision, any number of identical blocks after that would hash the same.

if you want a proof, submit a different image: the hashes will be identical, but different from your first attempt.

Can you explain the difference between a collision attack and a preimage attack? How can you get two PDFs with arbitrary contents having the same SHA1 without a preimage attack?

The pdfs don't have arbitrary content, they contain very specific headers (crafted by Google research), in one file the header selects one image, in the other it selects the other. These two headers are SHA1 colliding and the remainder of the files are identical.

Oh, that makes sense. Thank you!

Reply on news.ycombinator.com