Re:Sequoia PGP 1.0 Released: The Seedling Is a Sapling
by fanf2 on Wednesday December 16, 2020 @09:00PM
(#25451458)
You are describing a second preimage attack, ie, Eve finds a colliding message that matches an existing message and hash generated by Alice.
Not even MD5 is vulnerable to a second preimage attack.
The actual problem with SHA-1 is that Eve can generate two different messages with the same hash, one innocuous and one malicious. If Eve can get Alice to sign the innocuous message then Eve can use the signature to attack Bob using the malicious message.
Collisions are still catastrophic for most applications that use signatures, but it’s a wee bit harder to pull off an attack using pregenerated collisions than if you can find a second preimage. (Collision-based attacks need a signing oracle whereas second preimages do not.)
Not even MD5 is vulnerable to a second preimage attack.
The actual problem with SHA-1 is that Eve can generate two different messages with the same hash, one innocuous and one malicious. If Eve can get Alice to sign the innocuous message then Eve can use the signature to attack Bob using the malicious message.
Collisions are still catastrophic for most applications that use signatures, but it’s a wee bit harder to pull off an attack using pregenerated collisions than if you can find a second preimage. (Collision-based attacks need a signing oracle whereas second preimages do not.)