SHA256 vulnerability | Hacker News Reader

SHA256 vulnerability

github.com

6 pointsjstanley10 comments

This is not a vulnerability in SHA-256. See:

https://en.wikipedia.org/wiki/One-way_compression_function#D...

"A notable property of the Davies–Meyer construction is that even if the underlying block cipher is totally secure, it is possible to compute fixed points for the construction"

That is all that has been done here.

Duplicate https://news.ycombinator.com/item?id=14654696 .

This post keeps getting flagged and or deleted. There have been dozens of submissions of this in the past hour alone.

Oh, look who is adding "original" "research" to wikipedia: https://en.wikipedia.org/wiki/Special:Contributions/220.71.9...

AFAICT it checks out.

[UPDATE] I was wrong. Turns out this is not a vulnerability at all:

https://crypto.stackexchange.com/questions/48580/fixed-point...

How did you validate it exactly? The first thing would be to validate the sha256 implementation used I guess. If it's true it's huge but I find it hard to trust a random github repo with such an extraordinary claim, especially the very vague "I developed an entirely new type of cryptanalysis theory to achieve this. It has a similar form comparing to differential analysis." Raises many red flags as far as I'm concerned.

Even if it's true I'm not sure I understand how broad this attack vector could be. Can we generate collisions for any given hash or just a subset?

Given that SHA256 is used in cryptocurrencies it makes me even more skeptical, it could be an attempt at making the market crash with some FUD I guess.

The sha256.py in the attack repo matches https://github.com/thomdixon/pysha2/blob/master/sha2/sha256..... up to whitespace. I have not sure that it matches the NIST spec, but it matches wikipedia on emptystring...

> How did you validate it exactly?

I ran the example. Then I looked at the code. Then I ran random test vectors against hashlib.sha256.

It's not a slam-dunk, but if it's a hoax it's a damn good hoax.

It's not a good hoax at all. You can calculate fixed points for SHA256. This is a quirk, but it's not less costly than actually finding a collision, which means this is a non-vulnerability.

The author effectively hard-coded values.

> You can calculate fixed points for SHA256

Really? How?

[UPDATE] Heh, you're right.

https://crypto.stackexchange.com/questions/48580/fixed-point...

Reply on news.ycombinator.com