4 ms·
No, that's not the big problem. Every collision of this kind so far just requires a random looking section, and allows another section to be whatever you want.
by Natanael_L 10y ago
No, that's not the big problem. Every collision of this kind so far just requires a random looking section, and allows another section to be whatever you want. You can just swap out one file for malware.
- Ajedi32 10y agoAh, sorry. I got confused by this section on shattered.it, which seemed to be saying that merely requiring a certain level of entropy in the resulting documents would be enough to mitigate the attack: > Are TLS/SSL certificates at risk? [...] it is required that certificate authorities insert at least 20 bits of randomness inside the serial number field. If properly implemented this helps preventing a practical exploitation. After giving it a bit more thought though, I realize now though that this mitigation actually works by preventing the attacker from fully controlling the hash of the first, non-malicious document.
- schoen 10y agoThe project's site is referring to an outdated version of the requirement. As I noted above, the requirement they refer to is only a SHOULD (some CAs might not have complied with it) and was replaced at the end of September with a SHALL which requires 64 bits rather than 20. https://cabforum.org/2016/07/08/ballot-164/ https://cabforum.org/2016/07/08/ballot-164/ Edit: I told them about this and they've fixed it; it now says "64 bits" instead of "20 bits".
- Natanael_L 10y agoCA certs are different than the general case.
- jakob223 10y agoThis attack requires both to be, in some sense, "random looking". i.e. you can't generate a collision for an arbitrary first text.