4 ms·
Edit: Nevermind, I misinterpreted something in the report. Collisions between malicious and non-malicious documents are indeed most likely feasible. Original c
by Ajedi32 10y ago
Edit: Nevermind, I misinterpreted something in the report. Collisions between malicious and non-malicious documents are indeed most likely feasible.
Original comment:
While theoretically possible, I don't really see that particular attack as being an actual, practical problem anytime soon.
In order for that to work not only would you have to find _a_ collision, but you'd have to find one with the additional constraints of "one copy is malware free while the other isn't", which would be significantly more difficult (at least, as I understand it).
That said, I agree it's probably time for torrents to start moving to another hash function. With time and additional research, it's entirely possible that theoretical attacks like the one you described could eventually become practical.
- Natanael_L 10y agoNo, that's not the big problem. Every collision of this kind so far just requires a random looking section, and allows another section to be whatever you want. You can just swap out one file for malware.
- Ajedi32 10y agoAh, sorry. I got confused by this section on shattered.it, which seemed to be saying that merely requiring a certain level of entropy in the resulting documents would be enough to mitigate the attack: > Are TLS/SSL certificates at risk? [...] it is required that certificate authorities insert at least 20 bits of randomness inside the serial number field. If properly implemented this helps preventing a practical exploitation. After giving it a bit more thought though, I realize now though that this mitigation actually works by preventing the attacker from fully controlling the hash of the first, non-malicious document.
- schoen 10y agoThe project's site is referring to an outdated version of the requirement. As I noted above, the requirement they refer to is only a SHOULD (some CAs might not have complied with it) and was replaced at the end of September with a SHALL which requires 64 bits rather than 20. https://cabforum.org/2016/07/08/ballot-164/ https://cabforum.org/2016/07/08/ballot-164/ Edit: I told them about this and they've fixed it; it now says "64 bits" instead of "20 bits".
- Natanael_L 10y agoCA certs are different than the general case.
- jakob223 10y agoThis attack requires both to be, in some sense, "random looking". i.e. you can't generate a collision for an arbitrary first text.
- Pigo 10y agoI really don't see why anyone would go through all this trouble when you can still just put Star_Wars_XIII.exe out there and get 10k downloads.