4 ms·

Still seems less than ideal to be able to generate a second document that hashes to the same value.

• tialaramex 6y ago
  Your phrasing here is unclear. Being able to construct B such that hash(B) = hash(A) for some document A is Second Pre-image and there is no viable Second Pre-image attack for SHA-1 or even MD5. What does exist is collision, where you construct documents C and C' such that hash(C) = hash(C'). This means bad guys can persuade humans (and more importantly in most cases, machines) to sign seemingly innocuous document C; and then apparently produce proof document C' was signed even though the human / machine has never seen C' and would not have signed it.
  • im3w1l 6y ago
    Collision combined with length extension could be a neat way of attacking deduping. Basically first a prefix, then a collision block, then a suffix that is encrypted with a key derived from one of the collision blocks. If you can arrange for the deduper to find the document with the wrong key first, then it will skip over the super secret stuff.
    • formerly_proven 6y ago
      For deduplicated storage you really want A=B <=> H(A)=H(B) to hold for all data you are going to see, so accessible constructions for collisions should already bar an algorithm from this application.
      • im3w1l 6y ago
        I 100% agree, but some people seem to go "eh it's not a problem in practice" for as long as they possibly can.