8 ms·

Here's a good blog about how SHA-1 works: http://www.metamorphosite.com/one-way-hash-encryption-sha1-d.. http://www.metamorphosite.com/one-way-hash-encryption-

by ktta 10y ago

Here's a good blog about how SHA-1 works: http://www.metamorphosite.com/one-way-hash-encryption-sha1-d.. http://www.metamorphosite.com/one-way-hash-encryption-sha1-d.... The biggest risk I see with this is how torrents are affected: https://en.wikipedia.org/wiki/Torrent_poisoning https://en.wikipedia.org/wiki/Torrent_poisoning There's also a problem with git, but I don't see it being that as susceptible as torrents: http://stackoverflow.com/a/34599081/6448137 http://stackoverflow.com/a/34599081/6448137

rocqua 10y ago
What about git? This makes it technically possible to get a backdoored linux repo with the same commit hash. EDIT: this is wrong, it's not a second pre-image attack only a collision attack. That is, you can create 2 git repositories with the same commit hash, but not a git repo that matches an already existing repo. In other words, you can create 2 things with the same hash, but can't control what that hash actually is. You might be able to fashion 2 commits to the linux repo with the same hash but a different modification though.
- ktta 10y ago
  https://news.ycombinator.com/item?id=13713603 https://news.ycombinator.com/item?id=13713603
- rntz 10y ago
  EDIT: My original comment was wrong. Git commit signing apparently only signs the commit hash itself, so it's only as trustworthy as the integrity of the hash. However, see also other comments which point out that this isn't a pre-image attack; you can't find a collision for a given thing (in this case, the linux kernel); rather, you can generate from scratch two pieces of data which happen to collide. Still, this is worrying. ORIGINALLY (INCORRECT): Git commit hashes were at least never intended as a form of authentication. That's why git has commit signing. That said, they list GPG signatures as one of the things affected by SHA1 brokenness, so maybe even that's not enough? I don't know enough about how git commit signing or GPG works to tell.
  - nabla9 10y ago
    >git has commit signing What the commit actually signs? Is it the sha1 hash?
    - deleted 10y ago
      [deleted]
    - scrollaway 10y ago
      The commit object is signed; which contains a signature to both the tree and the parent. I don't see it as feasible to do a collision on both at once with the method outlined here, but maybe I'm missing something. Tagging on the other hand is at risk, as it's just the hash that's signed. Edit: You can check what is actually signed with `git cat-file -p $obj` where $obj is a commit or tag id.
      - deleted 10y ago
        [deleted]
      - mikegerwitz 10y ago
        You could also find a preimage for any tree or blob object referenced by that commit. And in large projects, you have a lot to choose from. (As has been stated, I know this isn't a second preimage attack.) Edit: See my answers in this thread: https://lists.gnu.org/archive/html/bug-guix/2016-06/msg00009.html https://lists.gnu.org/archive/html/bug-guix/2016-06/msg00009...
      - nabla9 10y ago
        It seems that commit object contains metadata and sha1 hash of the commit tree. In other words, signing comment object is not detecting if data is altered somewhere in the tree and creates identical sha1 hash.
  - beagle3 10y ago
    The signature affirms the validity of the SHA1 hash, so ... the GPG is not more helpful than the underlying SHA1.
  - 10y ago
- pgeorgi 10y ago
  Accidental collisions are still unlikely, it loses SHA1's "security" properties though. http://www.monotone.ca/docs/Hash-Integrity.html#Hash-Integrity http://www.monotone.ca/docs/Hash-Integrity.html#Hash-Integri... goes in some detail for a different (older) DSCM, but same issue.
c3833174 10y ago
>torrents Good, if something stronger and better comes out it'll still be a win.
- anilgulecha 10y ago
  Bittorrent is not a static/unchanged old protocol. It has constantly evolved to keep up with any attacks that could be mounted on it's distributed nature. I'm sure a BEP will also come up, and speedtracked on the back of this news.
  - ktta 10y ago
    The importance of that update cannot be understated. Torrents are much more viable to being exploited than anything else out there. I think everyone should be on alert for updates to their favorite torrent softwares.
problems 10y ago
I don't think we're likely to see it used for torrent poisoning if it takes 110 GPUs 1 year to compute a collision - the electricity costs for such a rig would be enormous. 110 GPUs * about 300 W each = about 290 thousand kilowatt hours to break. Electricity costs of at least 10s of thousands of dollars. For a single torrent. You better be damn confident that those torrenters are going to go buy your product and that they won't just go to the next torrent down the list. That said, attacks only get better, so it could happen at some point in the future and it's probably worth switching the hash function used sooner rather than later.
- mkj 10y ago
  Malware infecting a few hundred beefy-gpu PCs isn't implausible.
- mrb 10y ago
  "That said, attacks only get better" In the case of MD5 collision research, initially it took a cluster of PS4 months to find one. But a few years later a laptop can find a collision instantaneously. So yeah, expect rapid improvement of SHA1 collision feasibility.
compuguy 10y ago
What about l2tp/ipsec? It can use sha-1.

by ktta 10y ago

rocqua 10y ago

What about git? This makes it technically possible to get a backdoored linux repo with the same commit hash. EDIT: this is wrong, it's not a second pre-image attack only a collision attack. That is, you can create 2 git repositories with the same commit hash, but not a git repo that matches an already existing repo. In other words, you can create 2 things with the same hash, but can't control what that hash actually is. You might be able to fashion 2 commits to the linux repo with the same hash but a different modification though.

ktta 10y ago
https://news.ycombinator.com/item?id=13713603 https://news.ycombinator.com/item?id=13713603
rntz 10y ago
EDIT: My original comment was wrong. Git commit signing apparently only signs the commit hash itself, so it's only as trustworthy as the integrity of the hash. However, see also other comments which point out that this isn't a pre-image attack; you can't find a collision for a given thing (in this case, the linux kernel); rather, you can generate from scratch two pieces of data which happen to collide. Still, this is worrying. ORIGINALLY (INCORRECT): Git commit hashes were at least never intended as a form of authentication. That's why git has commit signing. That said, they list GPG signatures as one of the things affected by SHA1 brokenness, so maybe even that's not enough? I don't know enough about how git commit signing or GPG works to tell.
- nabla9 10y ago
  >git has commit signing What the commit actually signs? Is it the sha1 hash?
  - deleted 10y ago
    [deleted]
  - scrollaway 10y ago
    The commit object is signed; which contains a signature to both the tree and the parent. I don't see it as feasible to do a collision on both at once with the method outlined here, but maybe I'm missing something. Tagging on the other hand is at risk, as it's just the hash that's signed. Edit: You can check what is actually signed with `git cat-file -p $obj` where $obj is a commit or tag id.
    - deleted 10y ago
      [deleted]
    - mikegerwitz 10y ago
      You could also find a preimage for any tree or blob object referenced by that commit. And in large projects, you have a lot to choose from. (As has been stated, I know this isn't a second preimage attack.) Edit: See my answers in this thread: https://lists.gnu.org/archive/html/bug-guix/2016-06/msg00009.html https://lists.gnu.org/archive/html/bug-guix/2016-06/msg00009...
    - nabla9 10y ago
      It seems that commit object contains metadata and sha1 hash of the commit tree. In other words, signing comment object is not detecting if data is altered somewhere in the tree and creates identical sha1 hash.
- beagle3 10y ago
  The signature affirms the validity of the SHA1 hash, so ... the GPG is not more helpful than the underlying SHA1.
- 10y ago
pgeorgi 10y ago
Accidental collisions are still unlikely, it loses SHA1's "security" properties though. http://www.monotone.ca/docs/Hash-Integrity.html#Hash-Integrity http://www.monotone.ca/docs/Hash-Integrity.html#Hash-Integri... goes in some detail for a different (older) DSCM, but same issue.

c3833174 10y ago

>torrents Good, if something stronger and better comes out it'll still be a win.

anilgulecha 10y ago
Bittorrent is not a static/unchanged old protocol. It has constantly evolved to keep up with any attacks that could be mounted on it's distributed nature. I'm sure a BEP will also come up, and speedtracked on the back of this news.
- ktta 10y ago
  The importance of that update cannot be understated. Torrents are much more viable to being exploited than anything else out there. I think everyone should be on alert for updates to their favorite torrent softwares.

problems 10y ago

I don't think we're likely to see it used for torrent poisoning if it takes 110 GPUs 1 year to compute a collision - the electricity costs for such a rig would be enormous. 110 GPUs * about 300 W each = about 290 thousand kilowatt hours to break. Electricity costs of at least 10s of thousands of dollars. For a single torrent. You better be damn confident that those torrenters are going to go buy your product and that they won't just go to the next torrent down the list. That said, attacks only get better, so it could happen at some point in the future and it's probably worth switching the hash function used sooner rather than later.

mkj 10y ago
Malware infecting a few hundred beefy-gpu PCs isn't implausible.
mrb 10y ago
"That said, attacks only get better" In the case of MD5 collision research, initially it took a cluster of PS4 months to find one. But a few years later a laptop can find a collision instantaneously. So yeah, expect rapid improvement of SHA1 collision feasibility.

compuguy 10y ago

What about l2tp/ipsec? It can use sha-1.