A new collision attack 6 years after the first public example counts as magic? In the press release[0] by the authors of the discovery they describe the backsto

A new collision attack 6 years after the first public example counts as magic? In the press release[0] by the authors of the discovery they describe the backstory: > The first cryptographic collision attack against the cryptographic hash function MD5 was invented by Xiaoyun Wang et al. in 2004, which however did not pose a serious immediate threat due to technical limitations. Subsequently, we have devised a more flexible collision attack against MD5 in 2007, a so-called chosen-prefix collision attack. This posed a greater threat due to the removal of the most important technical limitation. Finally, we refined our attack in 2008 and used it to construct a rogue Certification Authority, thereby demonstrating a serious vulnerability in internet security. Our demonstration convinced Microsoft and various governments to raise the security standards for Certification Authorities, by disallowing the use of MD5-based signatures effective 15 January 2009. Flame was probably deployed around February 2010 and the practical attack was announced May 2007, giving 2.5 years for finding a variant and make and debug the malware. Seems reasonable if you have good cryptographers and development team, since the collision is fairly well contained functionality that doesn't block other parts of the project. Generally I would reserve the term "magic" for secret crypto that is better than state of the art, a new variant of state of the art is simply impressive. [0]: https://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-cryptographic-attack-variant-in-flame-spy-malware https://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-...