Slashdot Mirror
First Successful Collision Attack On the SHA-1 Hashing Algorithm (google.com)
Artem Tashkinov writes: Researchers from Dutch and Singapore universities have successfully carried out an initial attack on the SHA-1 hashing algorithm by finding a collision at the SHA1 compression function. They describe their work in the paper "Freestart collision for full SHA-1". The work paves the way for full SHA-1 collision attacks, and the researchers estimate that such attacks will become reality at the end of 2015. They also created a dedicated web site humorously called The SHAppening.
Perhaps the call to deprecate the SHA-1 standard in 2017 in major web browsers seems belated and this event has to be accelerated.
Perhaps the call to deprecate the SHA-1 standard in 2017 in major web browsers seems belated and this event has to be accelerated.
I don't know; every man has his breaking point.
<blink>down the rabbit hole</blink>
... if one day it gets out that this was discovered a long time again by certain intelligence agencies.
Git uses SHA1 so every git repository should now be considered compromised. Dice is holding an all-hands meeting this afternoon to find a replacement. Since sourceforge supports SVN and CVS, we may use them. They're highly performant, easy to use, and (most importantly) their crypto can't be broken since they don't have any.
Copyright (c) 1990 - 2014 Dice. All rights reserved. Use of this comment is subject to certain Terms and Conditions.
One thing that always bothered me with announcements like 'MD5 is dead because we can forge collisions' is that what are the chances that the forgery would pass *both* MD5 and SHA1 ?
Say you have a string S and a forged S' so that S != S' and MD5(S) = MD5(S') and let's say you can create S' easily regardless of S. That's the definition of a hash collision and a proof that the algorithm can't be trusted anymore. Surely, the odds that it also satisfies SHA1(S) = SHA1(S') are close enough to impossible, no?
If that's the case, then sign your certs, code, etc with concat(MD5(S),SHA1(S)) instead of just one broken hash. Yes, two broken hashes are indeed protecting you.
"The hallmark of humanity is the ability to move beyond sensory inputs" - Mary Helen Immordino-Yang
I have nothing more to say.
Sorry, this isn't that serious. You can't just walk up to a geisha 1 day and in fits and starts
handle all the encoding black-hattery of some random pasha 1 character per line. Seriously, duh
All this won't flip anyone's ricksha 1 morning. Another thing: SSL's still safe. At best it's a
1-time (or... maybe 2) opportunity to replace someone's kasha 1 grain at a time. But probably 1
I've fallen off your lawn, and I can't get up.
"Freestart collisions, like the one presented here, do not directly imply a collision for SHA-1."
LOL, I successfully trolled a mod. :)
That's going to keep me smiling all day!
And here I thought you were just smoking crack.
GP said IN ADDITION to, not "as the input of".
Not
hash = sha1(md5))
which would be weaker. Rather:
hash1 =sha1(plaintext) , hash2 =md5(plaintext)
Adding (not embedding) an additional hash is strictly stronger.
Of course it would be just as easy to add sha256 rather than to add md5. You could then deprecate the sha1 and after a while stop using it at all.
Of course it would be just as easy to add sha256 rather than to add md5. You could then deprecate the sha1 and after a while stop using it at all. If you keep the two hashes separate rather than concatenating them, you can deprecate a weaker one every ten years or so, as as needed. Instead of:
if matches (candidate, md5hash)
You'd use:
if matches (candidate, @undeprecated_hashes)
Compression function. 'nuff said...
It's ok. I realize wordplay makes a -->hash<-- out of many people's thought processes, and they can't do something as simple as moderate well in that kind of state. Not offended at all; there's no -->collision<-- between my feelings and clueless moderation of my posts. It strikes me as sad when other people's posts are similarly abused by moderators who can't -->look up<-- long enough to see what's being said, but hey, that's slashdot, where anyone can moderate for any reason, or no reason, or the wrong reason. And does. As we have seen here. There's no -->link<-- between the -->list<-- of who can moderate and who can "get it." Even when you provide the right -->pointers.<--
It's very much of like sarcasm. Without tags, some people are just lost. But the tags take part of the fun out of sarcasm, wordplay and just about every other form of humor, so I tend not to signal that hard, except as in the first paragraph here, when it is certain I'm dealing with someone who just "isn't going to get it" otherwise. Sarcasm or humor, wordplay or not. But... if you don't get it, you don't get it. S'ok. Regrettable, but still ok. I still had fun writing it. :)
PS:
o hash - SHA1 related term, also means confusion in the mind
o collision - hash related term, also means one thing disturbing another
o look up (lookup) - hash related term, also means change one's point of view
o link+list - technique used in hashing to resolve algorithmic collisions, also a joining of items
o pointers - variables which can be used to index a hash, also an indication to something
Bonus study material:
o acrostic technique
No, no. No need for thanks. Glad to help you out. :)
I've fallen off your lawn, and I can't get up.
It is called a freestart collision.
A freestart collision is one where the attacker gets to choose the initialization vector. In maybe all practical applications, it doesn't happen as it is fixed by the standard.
Unlike MD5, it is still impossible to get two different files that have the same standard SHA-1 checksum.
And even true collision attacks are quite limited. For many applications (like cracking passwords), what you need is a preimage attack, and neither MD5 nor SHA-1 have one.
The original Xbox and I have some unfinished business.
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
It's gotten to the point that, in order to encrypt anything safely for a few years, I have to invent a time machine and steal the technology from the future. And kill the inventor, so that he doesn't independently discover it in the original time stream.
We just got vendors to stop using MD5 and SSL 3.0 about a year ago.
Gamingmuseum.com: Give your 3D accelerator a rest.
'nuf said :D
> The work paves the way for full SHA-1 collision attacks, and the researchers estimate that such attacks will become reality at the end of 2015.
From the OP that is an *incorrect* summary of what the paper implies and what the researchers say.
They say that they can do a full faststart collision which looks like find h(c,m)=h(c',m') where SHA1(m1||m2)=h( h(iv,m1), m2 || length(m1||m2) ) and furthermore that there is no known way to convert a faststart collision into a SHA1 collision. Accuracy people, accuracy.
Of course it's not good news, and maybe someone will find other problems and manager in time to make a SHA1 collision, but this is not it.
Where's my next generation, fast, reliable, anonymous, decentralized, open source filesharing client?