News for hackers. Stuff that matters.

A comment on How easy is it in 2022 to find a SHA1 collision?. Parent comment

Re:How easy is it in 2022 to find a SHA1 collision? by iforgotpassword on Monday April 25, 2022 @07:03AM (#31152867)
If you use the hash (that we assume you aquired overa secure channel) to verify the download of eg an installer for some sensitive software, and someone manages to give you a backdoored installer instead with the same hash, that would be rather bad.
[ Parent | on HN ]
Re:How easy is it in 2022 to find a SHA1 collision? by iso1210 on Monday April 25, 2022 @09:08AM (#31153970)
I think the question is that how is it useful if you happen to have two hashes that match - it's very unlikely that they will be

Where the problem comes is when you can generate a matching 128 bit hash with your own content without having to do 2^128 different hashes (or strike ridiculously (lottery winner being struck by lightning) lucky and only need to do 2^100 hashes)

[ Parent | on HN ]
Re:How easy is it in 2022 to find a SHA1 collision? by walls on Monday April 25, 2022 @11:14AM (#31156031)
Lets say you have an anti-malware service that sees file1, analyzes it, and decides the file is benign. The service then updates a database saying 'hash xyz has been analyzed and is benign'.

Then you send file2 which is actually malicious, and the service decides it has already analyzed this file and lets it go.

This would work on a lot of big AV appliances and software. A surprising amount of these are still using md5 for de-duplication.

[ Parent | on HN ]
Re:How easy is it in 2022 to find a SHA1 collision? by pornel on Thursday April 28, 2022 @05:17PM (#31198334)
This specific attack is not possible against SHA-1 (yet).

The known collision weakness only allows generating two colliding pieces ahead of time with a hash value that you don't control. It does not give you ability to collide with a pre-existing file/pre-existing hash, so you can't attack any existing SHA-1-verified file. You can only attack files that you've specifically crafted/tricked to contain your colliding block.

[ Parent | on HN ]