Re:BitTorrent v2
by userbinator on Monday September 07, 2020 @07:05PM
(#24403680)
Remember that for cryptographers, "practical" or "broken" doesn't really mean "everyone can do it", and AFAIK there has only been one publicly released collision pair for SHA1, which also took an enormous amount of time and money to find.
Even MD5, for which you can generate colliding blocks in seconds on an average PC, is still quite resistant to preimage attacks.
In other words, even after spending the resources to find a colliding block, you'd also need to create both files with the same hash, and can't simply collide existing torrents' files and replace them with malicious ones.
You're assuming a malicious peer, but what about a malicious seeder? One could take an existing unsigned executable, add in NOPs and no one would notice (same thing for certain noises in audio/video files).
Since there's some control over the original hash value, executing step (4) is not exactly a preimage attack, it should be a bit easier.
If the seeder is malicious, there's no need to attack SHA1 at all. The seeder can't control which peers get which versions of any identical-SHA blocks — your target peer may share the bad block — so it seems easier to just upload the malicious content to everyone.
1. The user trusts the source of the .torrent file.
2. A malicious peer makes a preimage attack in some block in an executable file with contents containing some malicious executable payload.
3. The executable wasn't signed, or the targeted block must include executable headers.
4. Some peers get the malicious exe, some don't.
The (2) step is still hard — preimage attacks on SHA1 are still expensive.
And it is probably much easier to bypass SHA1/SHA256 entirely by just uploading a malicious torrent directly and hoping (1) still applies.