3 ms·

Yes, but for the specific concerns listed it should not be a problem. That is, if you upload to dropbox and check the sha1 when it comes back, yes you did get t

Yes, but for the specific concerns listed it should not be a problem. That is, if you upload to dropbox and check the sha1 when it comes back, yes you did get the same data back. And your data can't be stolen by a hash-to-data oracle either, unless the evil attacker constructed your secret data for you. So it depends on your threat model. Yes there are practical concerns, but not the ones listed.

mlyle 7y ago
I disagree. Deduplicating filesystems often depend on hash equivalency meaning data equivalency. They may or may not have modes to validate all data before deduplication, but these suck for performance and are often turned off. E.g. I make two things that hash to the same thing. One is a contract where I'm obligated to pay back a loan. Another is some meaningless document. I give them to a counterparty who puts them in their filesystem, which later scrubs and deduplicates data. Since they hash the same, the filesystem removes the contract and leaves my meaningless document (or never bothers to store the contract because it already exists, if deduping online, etc). Note that this is a chosen prefix collision, which is much more demanding (and more useful!) than finding a collision in general. And this leaves aside that SHA1 is looking increasingly vulnerable to preimage attacks which further broaden the attack scenarios.
- perl4ever 7y ago
  The filesystem removes a document, but you can't expect it will be the right one more than 50% of the time.
  - mlyle 7y ago
    An attacker may be able to control the way it happens. It may be repeatable to always remove the first or the last. If it's online dedup, it'll always be the last. Or the attacker can provide many copies of the document you want to still have a copy of, and one copy in the middle of the one that should be vanished.
im3w1l 7y ago
This doesn't sound crazy farfetched. I bet a lot of people have files in their dropbox that were created by someone else.

mlyle 7y ago

I disagree. Deduplicating filesystems often depend on hash equivalency meaning data equivalency. They may or may not have modes to validate all data before deduplication, but these suck for performance and are often turned off. E.g. I make two things that hash to the same thing. One is a contract where I'm obligated to pay back a loan. Another is some meaningless document. I give them to a counterparty who puts them in their filesystem, which later scrubs and deduplicates data. Since they hash the same, the filesystem removes the contract and leaves my meaningless document (or never bothers to store the contract because it already exists, if deduping online, etc). Note that this is a chosen prefix collision, which is much more demanding (and more useful!) than finding a collision in general. And this leaves aside that SHA1 is looking increasingly vulnerable to preimage attacks which further broaden the attack scenarios.

perl4ever 7y ago
The filesystem removes a document, but you can't expect it will be the right one more than 50% of the time.
- mlyle 7y ago
  An attacker may be able to control the way it happens. It may be repeatable to always remove the first or the last. If it's online dedup, it'll always be the last. Or the attacker can provide many copies of the document you want to still have a copy of, and one copy in the middle of the one that should be vanished.

im3w1l 7y ago

This doesn't sound crazy farfetched. I bet a lot of people have files in their dropbox that were created by someone else.