People who understand things well enough will know what first collision means, so can moderate their response.
Others who are less familiar with the ridiculous levels of subtlety around this sort of thing are better off being given the simple message that sha1 is now legacy in all cases. Helps to avoid mistakes.
I'm more surprised though at the resentful attitude towards the actual truth (in the non-alternative sense): collisions are useless in many cases and the necessary second pre-image is much more difficult to find.
At least in a forum like HN I'd expect intellectual honesty to prevail.
EDIT: Removed the incorrect example out of pure shame! :P
I of course agree we should replace SHA-1. But I still think a more intellectually honest discussion is meaningful. For example, after reading the link you referred to I'm rather convinced that X.509 is pretty seriously flawed, and could easily be redesigned to be collision resistant. Why not talk about that? Why not do it?
Doing x509 still means having to parse ASN.1 though, and nobody seems to actually like it.
https://z.cash/technology/history-of-hash-function-attacks.h...
Specifically the section 'When collision attacks do matter' and the referenced write-up at
But isn't the real lesson here that X.509 is flawed?
Also, as the linked article says:
> The bottom line is that no widely-studied hash function has ever succumbed to a (second-)pre-image attack except for one.
And there are signatures that are provably resistant to collisions, shouldn't we move to such signatures?
I don't think that's the case
And there are signatures that are provably resistant to collisions, shouldn't we move to such signatures?
It's just much simpler to move to a better hash function.
I don't see how one excludes the other. :P
Isn't it rather obvious that no third party can attack this system even if they can create an SHA-256 collision?
Sure, you can dream up some weird scenario where someone could set up two servers with different RSA public keys that would hash to the same value, so that the client could be fooled into connecting to one when it thought it was connected to the other. But to me it seems quite obvious that that's outside the treat model / irrelevant.
Especially in situations where you don't trust what's giving you the hash (e.g. because you haven't authenticated them yet, or because the application inherently means you can't trust them even if you have authenticated them) then collision resistance most likely necessary.
Sure, there is broken, and then even-more broken, but SHA-1 is already, for most practical purposes, useless.
> Explain why a simple collision attack is still useless, it's really the second pre-image attack that counts
Why is this the "non-expert reaction?" It's correct, right?
And why go to the trouble of making a timeline with "Broken" and "Collision found" without a "Second pre-image found"?
I'm genuinely puzzled (and have asked it here on HN before [1]), but I unfortunately suspect that an honest answer lies somewhere along these lines: "Second pre-images are a hell of lot more difficult to find than collisions, so if we waited around for a second pre-image to be found we'd never get to dance around like headless chickens and talk about really scary shit (which typically requires a second pre-image) as 'now practical'. That would make the whole field a lot less sexy, and cut into our 'expert' consulting fees..."
1. https://news.ycombinator.com/item?id=13729492
EDIT: I'm of course not advocating staying with SHA-1. There's absolutely no good reason to. Even years ago when I was last involved in choosing a cryptographic hash function (even truncated) SHA-256 was obviously a much better choice.