5 ms·

Collisions in the context of bittorrent are not a big deal. We could (and will, there are millions of torrents around that will never be updated) keep using SHA

Collisions in the context of bittorrent are not a big deal. We could (and will, there are millions of torrents around that will never be updated) keep using SHA1 and the world is not going to end.

frenchman99 6y ago
It isn't? Is it not possible to be tricked into downloading a malicious binary that you then execute on your computer?
- calvinmorrison 6y ago
  Unlike the Photoshop 2020 WareZ Cracked Unlocked 2020 Xvid Torrentz WZ FUN.torrent, that I just downloaded
  - vermilingua 6y ago
    Yes, because warez is the only valid use of bittorrent. Most Linux distros offer an installation iso via torrent, large files with many blocks. If you can change just a small part of those files, you’ve got compromised machines before the install even begins.
    - mlyle 6y ago
      Most of the practical hash attacks we've seen allow one to create two chunks of data that hash to the same thing, not to collide with an arbitrary other block. This greatly limits the attack scenarios we need to worry about. (That is, we've got practical collision attacks emerging for SHA1, not pre-image attacks).
    - userbinator 6y ago
      You would need to create a colliding pair (because the single existing one is so well known), itself not a simple thing, and create the two executables specifically with additional code discriminating between the two pairs to do two different things. You can't replace existing files with this attack, which means you'd have to create your own Linux distro with this extra "feature" and can't attack existing ones.
- loeg 6y ago
  I don't think so. 1. The user trusts the source of the .torrent file. 2. A malicious peer makes a preimage attack in some block in an executable file with contents containing some malicious executable payload. 3. The executable wasn't signed, or the targeted block must include executable headers. 4. Some peers get the malicious exe, some don't. The (2) step is still hard — preimage attacks on SHA1 are still expensive. And it is probably much easier to bypass SHA1/SHA256 entirely by just uploading a malicious torrent directly and hoping (1) still applies.
  - userbinator 6y ago
    Remember that for cryptographers, "practical" or "broken" doesn't really mean "everyone can do it", and AFAIK there has only been one publicly released collision pair for SHA1, which also took an enormous amount of time and money to find. Even MD5, for which you can generate colliding blocks in seconds on an average PC, is still quite resistant to preimage attacks. In other words, even after spending the resources to find a colliding block, you'd also need to create both files with the same hash, and can't simply collide existing torrents' files and replace them with malicious ones.
  - yyyk 6y ago
    You're assuming a malicious peer, but what about a malicious seeder? One could take an existing unsigned executable, add in NOPs and no one would notice (same thing for certain noises in audio/video files). Since there's some control over the original hash value, executing step (4) is not exactly a preimage attack, it should be a bit easier.
    - loeg 6y ago
      If the seeder is malicious, there's no need to attack SHA1 at all. The seeder can't control which peers get which versions of any identical-SHA blocks — your target peer may share the bad block — so it seems easier to just upload the malicious content to everyone.
flatline 6y ago
They aren’t? So someone can craft a payload that contains a rootkit or similar and has the same name and hash as the thing you wanted, and this is okay? (Disclaimer: I don’t know all that much about how hashes are used internal to the protocol)
- armitron 6y ago
  The vast majority of data shared over bittorrent is not executable. So your scenario becomes an issue if you're downloading executable data that you deem :trusted: without any additional verification besides the hash itself. If that's the case, you have bigger worries than the hash.
  - dmurray 6y ago
    Or if there's a vulnerability in a popular media player.
- sp332 6y ago
  The weakness is a collision, not a pre-image attack. That means that a pair of payloads can be crafted together, one innocent and one malicious, that have the same hash. But it is not feasible to take a given file and make a new malicious payload with a matching hash. So if you get your hash from whoever made the original binary, you can know that any binary with a matching hash is fine. But it could be a problem if someone creates a new pair of binaries and uploads the hash to TPB. You might see lots of good reviews from people who got the innocent version, but then the peers you connect to send you a malicious version with a matching hash.
aeyes 6y ago
They were a big deal on other networks using for example MD5, due to collisions malicious clients would just send you garbage parts. You wouldn't notice until finishing the complete download just to see that the file was corrupted.

Collisions in the context of bittorrent are not a big deal. We could (and will, there are millions of torrents around that will never be updated) keep using SHA1 and the world is not going to end.

frenchman99 6y ago

It isn't? Is it not possible to be tricked into downloading a malicious binary that you then execute on your computer?

calvinmorrison 6y ago
Unlike the Photoshop 2020 WareZ Cracked Unlocked 2020 Xvid Torrentz WZ FUN.torrent, that I just downloaded
- vermilingua 6y ago
  Yes, because warez is the only valid use of bittorrent. Most Linux distros offer an installation iso via torrent, large files with many blocks. If you can change just a small part of those files, you’ve got compromised machines before the install even begins.
  - mlyle 6y ago
    Most of the practical hash attacks we've seen allow one to create two chunks of data that hash to the same thing, not to collide with an arbitrary other block. This greatly limits the attack scenarios we need to worry about. (That is, we've got practical collision attacks emerging for SHA1, not pre-image attacks).
  - userbinator 6y ago
    You would need to create a colliding pair (because the single existing one is so well known), itself not a simple thing, and create the two executables specifically with additional code discriminating between the two pairs to do two different things. You can't replace existing files with this attack, which means you'd have to create your own Linux distro with this extra "feature" and can't attack existing ones.
loeg 6y ago
I don't think so. 1. The user trusts the source of the .torrent file. 2. A malicious peer makes a preimage attack in some block in an executable file with contents containing some malicious executable payload. 3. The executable wasn't signed, or the targeted block must include executable headers. 4. Some peers get the malicious exe, some don't. The (2) step is still hard — preimage attacks on SHA1 are still expensive. And it is probably much easier to bypass SHA1/SHA256 entirely by just uploading a malicious torrent directly and hoping (1) still applies.
- userbinator 6y ago
  Remember that for cryptographers, "practical" or "broken" doesn't really mean "everyone can do it", and AFAIK there has only been one publicly released collision pair for SHA1, which also took an enormous amount of time and money to find. Even MD5, for which you can generate colliding blocks in seconds on an average PC, is still quite resistant to preimage attacks. In other words, even after spending the resources to find a colliding block, you'd also need to create both files with the same hash, and can't simply collide existing torrents' files and replace them with malicious ones.
- yyyk 6y ago
  You're assuming a malicious peer, but what about a malicious seeder? One could take an existing unsigned executable, add in NOPs and no one would notice (same thing for certain noises in audio/video files). Since there's some control over the original hash value, executing step (4) is not exactly a preimage attack, it should be a bit easier.
  - loeg 6y ago
    If the seeder is malicious, there's no need to attack SHA1 at all. The seeder can't control which peers get which versions of any identical-SHA blocks — your target peer may share the bad block — so it seems easier to just upload the malicious content to everyone.

flatline 6y ago

They aren’t? So someone can craft a payload that contains a rootkit or similar and has the same name and hash as the thing you wanted, and this is okay? (Disclaimer: I don’t know all that much about how hashes are used internal to the protocol)

armitron 6y ago
The vast majority of data shared over bittorrent is not executable. So your scenario becomes an issue if you're downloading executable data that you deem :trusted: without any additional verification besides the hash itself. If that's the case, you have bigger worries than the hash.
- dmurray 6y ago
  Or if there's a vulnerability in a popular media player.
sp332 6y ago
The weakness is a collision, not a pre-image attack. That means that a pair of payloads can be crafted together, one innocent and one malicious, that have the same hash. But it is not feasible to take a given file and make a new malicious payload with a matching hash. So if you get your hash from whoever made the original binary, you can know that any binary with a matching hash is fine. But it could be a problem if someone creates a new pair of binaries and uploads the hash to TPB. You might see lots of good reviews from people who got the innocent version, but then the peers you connect to send you a malicious version with a matching hash.

aeyes 6y ago

They were a big deal on other networks using for example MD5, due to collisions malicious clients would just send you garbage parts. You wouldn't notice until finishing the complete download just to see that the file was corrupted.