3 ms·
Yeah, this is the difference between a collision and a preimage attack. A collision is, given a hash function, come up with two documents with the same hash, bu
by geofft 8y ago
Yeah, this is the difference between a collision and a preimage attack. A collision is, given a hash function, come up with two documents with the same hash, but you can control both documents. A preimage attack is, given a hash function and one document (or one hash), find another document with the same hash. That's much harder - you don't have the ability to force the algorithm's internal state into something convenient.
A preimage attack is what you worry about if you think the person giving you the signature might be untrustworthy, e.g., they're currently promising one thing but they might swap it out with something else later. A collision attack is what you worry about even if you don't think the person giving you the signature is untrustworthy and you're expecting someone else to swap out the document before it gets to you. So there are a good handful of scenarios where you don't care about preimage attacks but you do care about collisions - e.g., if Microsoft is signing Windows Update files, presumably they don't need to conduct a preimage attack to send you a malicious update, they can just directly sign a malicious update. But you don't want other people sending you malicious updates that appear to be signed by Microsoft.
- jtaft 8y agoThanks for the clarification. I thought Columbia's definition of a pre-image attack was incorrect, due to the vagueness of the verbiage "existing file". Ie, I considered the chosen document created by google as an "existing file".
- hcs 8y agoIs your second paragraph reversed? It seems like a collision is where you'd worry about someone having prepared two documents that they could swap.
- geofft 8y agoYes, you're right, sorry, I completely swapped the two terms in that entire paragraph.
- Moodles 8y ago> A preimage attack is what you worry about if you think the person giving you the signature might be untrustworthy, e.g., they're currently promising one thing but they might swap it out with something else later. A collision attack is what you worry about even if you don't think the person giving you the signature is untrustworthy and you're expecting someone else to swap out the document before it gets to you You mean vice versa right? Untrustworthy person: could make a collision before giving you the input and mess you around. Trustworthy person doesn't do that (because they are trustworthy). But someone might find a second pre-image attack and do it later on
- geofft 8y agoYes, sorry. Please swap "preimage attack" and "collision" in that entire paragraph: I meant to say there were cases where you don't care about a collision (as demonstrated for SHA-1) but you do care about a preimage (not yet demonstrated, but certainly a risk).