3 ms·
Actually, the website does cover this in the '''Q&A''' section: > What is a chosen-prefix collision? > A classical collision (or identical-prefix collision) f
by RickHull 7y ago
Actually, the website does cover this in the '''Q&A''' section:
> What is a chosen-prefix collision?
> A classical collision (or identical-prefix collision) for a hash function H is simply two messages M and M’ that lead to the same hash output: H(M) = H(M’). Even though this security notion is fundamental in cryptography, exploiting a classical collision for attacks in practice is difficult.
> A chosen-prefix collision is a more constrained (and much more difficult to obtain) type of collision, where two message prefixes P and P’ are first given as challenge to the adversary, and his goal is then to compute two messages M and M’ such that H(P || M) = H(P’ || M’), where || denotes concatenation.
> With such an ability, the attacker can obtain a collision even though prefixes can be chosen arbitrarily (and thus potentially contain some meaningful information). This is particularly impactful when the hash function is used in a digital signature scheme, one of the most common usage of a hash function.
- nneonneo 7y agoThe confusing thing is that the team behind SHAttered did choose a prefix - they just had to choose a common prefix rather than two different prefixes (choosing a common prefix simply changes the initial state used by SHA-1). So I'm hoping that my post clarifies this point a bit. The SHAttered attack (classical collision) can be used in practice - for example, my project https://github.com/nneonneo/sha1collider https://github.com/nneonneo/sha1collider exploits their collision to turn any two PDFs into documents with identical SHA-1 hashes.
- gowld 7y agoIs any practical application safe from Shattered but not Shambles?
- saagarjha 7y agoApplications which don't accept the specific Shattered PDF prefix given there. In general Shattered could work for e.g. ELF executables with the same prefix, but the attack here lets you collide the hashes even if the prefixes are different.