3 ms·

This isn't actually a vulnerability yet, as SHA-1 is only known to be vulnerable to collision attacks (where you try to find two messages with the same hash) ra

This isn't actually a vulnerability yet, as SHA-1 is only known to be vulnerable to collision attacks (where you try to find two messages with the same hash) rather than pre-image attacks (where you try to find a message with a specific hash); almost no hash functions have ever been found to be vulnerable to pre-image attacks: https://github.com/zooko/hash-function-survey/blob/master/preimage-attacks-color.rst https://github.com/zooko/hash-function-survey/blob/master/pr... Secondly, the issue is moot because generating collisions on 80 bits takes just 2^40 work - not hard at all. Basically what that means for Tor, is that while it'd be pretty easy for a Onion site operator to generate two keys corresponding to the same .onion address, an _attacker_ still has to do 2^80 work to attack a site by generating a key with the same Onion address. While that's not great - 2^128 work is considered "standard" in cryptographic work - 2^80 work is still hard enough that there are probably cheaper ways of attacking Onion sites (for reference, the cumulative total work done by all Bitcoin network miners in the entire history of Bitcoin is about 2^80 hashes). As for the 1024bit pubkeys, I'm not sure what the status of that is; from what I hear Tor is actively working towards a Onion redesign that will fix these issues, and longer pubkeys may have already been fixed.

zmanian 11y ago
Tor 224 proposes moving hidden service addresses to full ed25519 keys rather than truncated hashes of RSA keys amongst other things. https://gitweb.torproject.org/torspec.git/tree/proposals/224-rend-spec-ng.txt https://gitweb.torproject.org/torspec.git/tree/proposals/224...
baby 11y ago
nitpicking but: > This isn't actually a vulnerability yet, as SHA-1 is only known to be vulnerable to collision attacks should be: * this isn't a vulnerability (there are no reason to believe that we might see it vulnerable to pre-image attacks one day) * SHA-1 is thought to become vulnerable to collision attacks > total work done by all Bitcoin network miners in the entire history of Bitcoin is about 2^80 hashes without thinking of hashes, current cycles done per second by the bitcoin network is around 2^90
- dsp1234 11y ago
  SHA-1 is thought to become vulnerable to collision attacks SHA-1 is actually known to be, not just thought to become, vulnerable to collision attacks at less than the full bit strength of the hash[0]. The important part is the pre-image resistance, of which there is no known attack. https://en.wikipedia.org/wiki/SHA-1#Attacks https://en.wikipedia.org/wiki/SHA-1#Attacks
  - baby 11y ago
    Right, it's more than certain now that with time we will be able to find a collision ("an estimated cost of $2.77M to break a single hash value by renting CPU power from cloud servers"). But there is a difference between the theory and actually finding a collision. And then a huge difference as well on how to exploit that.

zmanian 11y ago

Tor 224 proposes moving hidden service addresses to full ed25519 keys rather than truncated hashes of RSA keys amongst other things. https://gitweb.torproject.org/torspec.git/tree/proposals/224-rend-spec-ng.txt https://gitweb.torproject.org/torspec.git/tree/proposals/224...

baby 11y ago

nitpicking but: > This isn't actually a vulnerability yet, as SHA-1 is only known to be vulnerable to collision attacks should be: * this isn't a vulnerability (there are no reason to believe that we might see it vulnerable to pre-image attacks one day) * SHA-1 is thought to become vulnerable to collision attacks > total work done by all Bitcoin network miners in the entire history of Bitcoin is about 2^80 hashes without thinking of hashes, current cycles done per second by the bitcoin network is around 2^90

dsp1234 11y ago
SHA-1 is thought to become vulnerable to collision attacks SHA-1 is actually known to be, not just thought to become, vulnerable to collision attacks at less than the full bit strength of the hash[0]. The important part is the pre-image resistance, of which there is no known attack. https://en.wikipedia.org/wiki/SHA-1#Attacks https://en.wikipedia.org/wiki/SHA-1#Attacks
- baby 11y ago
  Right, it's more than certain now that with time we will be able to find a collision ("an estimated cost of $2.77M to break a single hash value by renting CPU power from cloud servers"). But there is a difference between the theory and actually finding a collision. And then a huge difference as well on how to exploit that.