3 ms·

Honest question: has this any relevance outside of academia?

by _pmf_ 7y ago

tialaramex 7y ago
Sure. Consider the Web PKI ("SSL Certificates"). Suppose you have a web site pmf.example it is of course pretty easy to get yourself a certificate to make https://pmf.example/ https://pmf.example/ work, today for free but even many years ago it was pretty affordable from several commercial vendors. The way those certificates work is they use a digital signature based on a hash algorithm, the CA uses its private key to sign the hash, and that's how computers can immediately tell a real certificate from a bogus one and be sure this is really news.ycombinator.com and not say, your ISP's advertising front end injecting a "special offer". The CA will refuse to give you a certificate for google.com or news.ycombinator.com because those aren't yours. But using a chosen prefix attack you can create two documents with the same hash. One of them might be a fairly ordinary looking certificate for pmf.example that you're entitled to, the other says you're google.com You get a CA to sign the first certificate, then you simply snip off their signature and attach it to the second one, since their hashes are the same the signature matches. You now have a valid certificate for google.com. Not theory, practice, this was really done with an earlier broken hash, MD5. e.g. https://hackaday.com/2008/12/30/25c3-hackers-completely-break-ssl-using-200-ps3s/ https://hackaday.com/2008/12/30/25c3-hackers-completely-brea... A similar trick, probably done by or on behalf of the US and/or Israeli governments makes Flame work by colliding MD5 for code signing. That uses a collision nobody publicly knew about, which is a weird and expensive thing to do but of course governments have lots of money. https://en.wikipedia.org/wiki/Flame_(malware) https://en.wikipedia.org/wiki/Flame_(malware)
- chadmeister 7y ago
  Very enlightening. Thank you for explaining this. Are there any resources you might recommend to someone looking to learn this stuff more in depth?
  - adricnet 7y ago
    Ange Albertini's work on collisions is pretty great and he makes lots of example images and illustrations. https://corkami.github.io/ https://corkami.github.io/ In particular he works on/with the PoC||GTFO team and is responsible for the MD5 collision cover art in a past issue: https://github.com/angea/pocorgtfo https://github.com/angea/pocorgtfo For SHA-1 (and others) you might find more at his github project: https://github.com/corkami/collisions https://github.com/corkami/collisions hth, adric

Honest question: has this any relevance outside of academia?

by _pmf_ 7y ago

Honest question: has this any relevance outside of academia?

Sure. Consider the Web PKI ("SSL Certificates"). Suppose you have a web site pmf.example it is of course pretty easy to get yourself a certificate to make https://pmf.example/ https://pmf.example/ work, today for free but even many years ago it was pretty affordable from several commercial vendors. The way those certificates work is they use a digital signature based on a hash algorithm, the CA uses its private key to sign the hash, and that's how computers can immediately tell a real certificate from a bogus one and be sure this is really news.ycombinator.com and not say, your ISP's advertising front end injecting a "special offer". The CA will refuse to give you a certificate for google.com or news.ycombinator.com because those aren't yours. But using a chosen prefix attack you can create two documents with the same hash. One of them might be a fairly ordinary looking certificate for pmf.example that you're entitled to, the other says you're google.com You get a CA to sign the first certificate, then you simply snip off their signature and attach it to the second one, since their hashes are the same the signature matches. You now have a valid certificate for google.com. Not theory, practice, this was really done with an earlier broken hash, MD5. e.g. https://hackaday.com/2008/12/30/25c3-hackers-completely-break-ssl-using-200-ps3s/ https://hackaday.com/2008/12/30/25c3-hackers-completely-brea... A similar trick, probably done by or on behalf of the US and/or Israeli governments makes Flame work by colliding MD5 for code signing. That uses a collision nobody publicly knew about, which is a weird and expensive thing to do but of course governments have lots of money. https://en.wikipedia.org/wiki/Flame_(malware) https://en.wikipedia.org/wiki/Flame_(malware)

chadmeister 7y ago
Very enlightening. Thank you for explaining this. Are there any resources you might recommend to someone looking to learn this stuff more in depth?
- adricnet 7y ago
  Ange Albertini's work on collisions is pretty great and he makes lots of example images and illustrations. https://corkami.github.io/ https://corkami.github.io/ In particular he works on/with the PoC||GTFO team and is responsible for the MD5 collision cover art in a past issue: https://github.com/angea/pocorgtfo https://github.com/angea/pocorgtfo For SHA-1 (and others) you might find more at his github project: https://github.com/corkami/collisions https://github.com/corkami/collisions hth, adric