Re:Microsoft is Abandoning SHA-1 Hashes for Updates
by tialaramex on Wednesday February 20, 2019 @08:58AM
(#19207792)
No. Amateurs bring this up _all the time_. Depending on exactly what's going on, it may be no harder to attack _both_ than just the hardest of the two component hashes, plus you just wasted a bunch of effort and maybe introduced extra security bugs with your extra complexity. So don't do this.
The compatibility argument makes sense, but the "maybe it's safer" argument doesn't have any traction at all.
And the politics always ends up being "We don't want to endorse this unsafe thing, let's just remove it".
Re:Microsoft is Abandoning SHA-1 Hashes for Updates
by userbinator on Wednesday February 20, 2019 @08:40PM
(#19213818)
Depending on exactly what's going on, it may be no harder to attack _both_ than just the hardest of the two component hashes
We have seen published collisions for MD5 (which are incidentally nearly trivial to generate these days), and I'm aware of the one for SHA-1 (which took much longer to generate) --- but have there been any dual-collisions found? According to you, they wouldn't be that hard to generate, but I haven't been able to find any examples of dual collisions, even for trivially-collidable-by-themselves combinations like MD5+MD4.
Furthermore, wouldn't trying to collide both SHA2 and SHA1 be even more close to impossible than just trying to collide SHA2 (which is already currently regarded as practically impossible)? Perhaps newer clients should verify both hashes?