4 ms·

That's not quite what he's saying. He's saying it's using the same research but you can't reuse a hash collision like that since the contents of the two images

That's not quite what he's saying. He's saying it's using the same research but you can't reuse a hash collision like that since the contents of the two images you give it are unknown before hand.

dsp1234 10y ago
You can reuse the PDF from Google because it's not particularly reliant on the contents of the images. You can replace the images that Google used with your own (indeed that's what the service does) and it will output two files that themselves have the same hash (but that hash will be different than the original provided PDFs)
- simcop2387 10y ago
  Interesting. I need to read more into this because I didn't think that kind of thing was possible. I thought you'd have to recalculate it from scratch because of the two images being different but apparently I didn't understand how this worked.
  - dsp1234 10y ago
    (very)psuedocode: goto showImage1; showImage1: renderImage1(); exit showImage2: renderImage2(); exit If an attacker can hash a block that means "goto showImage1" and "goto showImage2" with the same hash, then you can see that the contents of those images doesn't matter, as long as the data for those images occurs after the logic for choosing them. (and no that's not what this attack does in reality, but just a logical framework for understanding why the images don't matter)
  - modeless 10y ago
    Both images are in both files. The only difference is the part of the file (where Google put the collision) which switches the image shown.
furyofantares 10y ago
You can reuse a collision by appending identical data to both pieces of colliding data and the result still collides. The collision google found exists in the PDF before the JPEGs, and both JPEGs are appended after the collision -- the difference in the earlier data is where the differing instructions exist that say either to display the first or the second JPEG.
- simcop2387 10y ago
  I see, i had misunderstood how they had done their attack. Makes a lot of sense.

That's not quite what he's saying. He's saying it's using the same research but you can't reuse a hash collision like that since the contents of the two images you give it are unknown before hand.

dsp1234 10y ago

You can reuse the PDF from Google because it's not particularly reliant on the contents of the images. You can replace the images that Google used with your own (indeed that's what the service does) and it will output two files that themselves have the same hash (but that hash will be different than the original provided PDFs)

simcop2387 10y ago
Interesting. I need to read more into this because I didn't think that kind of thing was possible. I thought you'd have to recalculate it from scratch because of the two images being different but apparently I didn't understand how this worked.
- dsp1234 10y ago
  (very)psuedocode: goto showImage1; showImage1: renderImage1(); exit showImage2: renderImage2(); exit If an attacker can hash a block that means "goto showImage1" and "goto showImage2" with the same hash, then you can see that the contents of those images doesn't matter, as long as the data for those images occurs after the logic for choosing them. (and no that's not what this attack does in reality, but just a logical framework for understanding why the images don't matter)
- modeless 10y ago
  Both images are in both files. The only difference is the part of the file (where Google put the collision) which switches the image shown.

furyofantares 10y ago

You can reuse a collision by appending identical data to both pieces of colliding data and the result still collides. The collision google found exists in the PDF before the JPEGs, and both JPEGs are appended after the collision -- the difference in the earlier data is where the differing instructions exist that say either to display the first or the second JPEG.

simcop2387 10y ago
I see, i had misunderstood how they had done their attack. Makes a lot of sense.