4 ms·

You could (try to) collide one of the blocks at the end of the tree. The tree of hashes will still be the same since the hash of the block didn't change. Then

by pgeorgi 10y ago

You could (try to) collide one of the blocks at the end of the tree. The tree of hashes will still be the same since the hash of the block didn't change. Then join the torrent with a client that doesn't download but only upload that block (there will be some that will pick it from you). Many legit copies, except for those that were so unlucky to fetch the block from you. If you manage to build such a block based on one in recurring content (eg. a distributor's logo at the beginning of the file), it could be reused, too.

koolba 10y ago
> You could (try to) collide one of the blocks at the end of the tree. The tree of hashes will still be the same since the hash of the block didn't change. Except you can't do that as this isn't a preimage attack. You can't create an arbitrary bad file matching an existing SHA-1 with this.
- pgeorgi 10y ago
  One of the good parts of doing it at the leaf hashes over the top level hash as proposed further up the thread is that quicktime/avi/etc are much more amenable to carrying some "junk" data than trying to figure out two colliding merkle tries with the same hash.
- jakeogh 10y ago
  On the other hand it's useful for denial of service. If you want to disrupt a swarm feeding it bad data is 'good enough'.
  - koolba 10y ago
    > On the other hand it's useful for denial of service. If you want to disrupt a swarm feeding it bad data is 'good enough'. No you can't do that either. Again, this is not a preimage attack: https://en.wikipedia.org/wiki/Preimage_attack https://en.wikipedia.org/wiki/Preimage_attack That means you can't use this to match an arbitrary SHA-1. That means you can't use it to generate bad parts of a larger file. What you're describing is already possible by having clients connect to a swarm, pretend they have parts of a file, and send gibberish. The receiver won't know until they finished downloading the part and hence waste the part-size in download capacity (i.e. DOS). I bet with IPv6 it'd be really easy to have a single malicious client pretend to be a world of swarm members.
    - jakeogh 10y ago
      Thanks, so it can gen 2 same size colliding chunks, but it can not take an arb chunk and generate a collision for it. Right?
      - koolba 10y ago
        Yes that's my understanding of it. In the PDF example on the site, the file format allows enough tweaking to the raw data without impacting the content to make it feasible.
- Natanael_L 10y ago
  If you created the original torrent then you can do it

by pgeorgi 10y ago

koolba 10y ago

> You could (try to) collide one of the blocks at the end of the tree. The tree of hashes will still be the same since the hash of the block didn't change. Except you can't do that as this isn't a preimage attack. You can't create an arbitrary bad file matching an existing SHA-1 with this.

pgeorgi 10y ago
One of the good parts of doing it at the leaf hashes over the top level hash as proposed further up the thread is that quicktime/avi/etc are much more amenable to carrying some "junk" data than trying to figure out two colliding merkle tries with the same hash.
jakeogh 10y ago
On the other hand it's useful for denial of service. If you want to disrupt a swarm feeding it bad data is 'good enough'.
- koolba 10y ago
  > On the other hand it's useful for denial of service. If you want to disrupt a swarm feeding it bad data is 'good enough'. No you can't do that either. Again, this is not a preimage attack: https://en.wikipedia.org/wiki/Preimage_attack https://en.wikipedia.org/wiki/Preimage_attack That means you can't use this to match an arbitrary SHA-1. That means you can't use it to generate bad parts of a larger file. What you're describing is already possible by having clients connect to a swarm, pretend they have parts of a file, and send gibberish. The receiver won't know until they finished downloading the part and hence waste the part-size in download capacity (i.e. DOS). I bet with IPv6 it'd be really easy to have a single malicious client pretend to be a world of swarm members.
  - jakeogh 10y ago
    Thanks, so it can gen 2 same size colliding chunks, but it can not take an arb chunk and generate a collision for it. Right?
    - koolba 10y ago
      Yes that's my understanding of it. In the PDF example on the site, the file format allows enough tweaking to the raw data without impacting the content to make it feasible.
Natanael_L 10y ago
If you created the original torrent then you can do it