3 ms·
I wish there were sample documents, but if one had two computed hashes would this mitigate this SHA1-shattered flaw ? e.g. good_doc.pdf sha1=da39a3ee5e6b4b0d325
by bch 10y ago
I wish there were sample documents, but if one had two computed hashes would this mitigate this SHA1-shattered flaw ? e.g. good_doc.pdf sha1=da39a3ee5e6b4b0d3255bfef95601890afd80709, md5=d41d8cd98f00b204e9800998ecf8427e ? With the sample project I'm looking at (GraphicsMagick) on Sourceforge for example, it provides both SHA-1 and MD5 hashes...
- bch 10y agoUgh -- browsing on a desktop now I clearly see there are two sample PDFs, and: host$ sha1 ./Downloads/shattered-* SHA1 (./Downloads/shattered-1.pdf) = 38762cf7f55934b34d179ae6a4c80cadccbb7f0a SHA1 (./Downloads/shattered-2.pdf) = 38762cf7f55934b34d179ae6a4c80cadccbb7f0a host$ md5 ./Downloads/shattered-* MD5 (./Downloads/shattered-1.pdf) = ee4aa52b139d925f8d8884402b0a750c MD5 (./Downloads/shattered-2.pdf) = 5bd9d8cabc46041579a311230539b8d1 host$
- fletom 10y agoWhy would you ever want to add a second broken hash like MD5 instead of just using a single secure function like SHA2, SHA3, or BLAKE2?
- bch 10y agoOnly for the case like I mentioned (SourceForge example above) of verifying payloads that only ship with those two broken hashes. Not advocating for publishing new work like this.