I'm not an expert, so I might be confused, but... To do that, wouldn't you need to construct a file that simultaneously had two collisons for the same file: on

I'm not an expert, so I might be confused, but... To do that, wouldn't you need to construct a file that simultaneously had two collisons for the same file: one collision for the torrent sha1, and one for the hash of the torrent (the magnet uri)? The link you gave for finding a single collision in certain types of files (rar, sh, jpg) required putting garbage into the malicious file (eg, in comments in the sh file). They didn't mention creating collisions in torrent files. It seems exceedingly unlikely to me that you'd be able to construct a file containing two simultaneous collisions, unless there's a spot where you can add garbage without corrupting the file, both in the torrent file and also in the hash of the torrent. I think the RIAA would be very interested if it was that easy to create fake torrents that hash the same. Edit: Actually your second link doesn't even show a weakness in SHA1. So you can't create a malicious torrent using that method.