3 ms·

> SHA-1 is only broken for collisions Only… broken… for… collisions. This is going to be my last reply to you, because this response is so confused that I thi

> SHA-1 is only broken for collisions Only… broken… for… collisions. This is going to be my last reply to you, because this response is so confused that I think you're beyond help. SHA-1 is used to validate long messages. 1. The sender, Alice, computes the (relatively short) SHA-1 hash H of a long message M 2. Alice cryptographically signs the hash H with a signature S 3. Bob can verify the whole message by verifying that the hash H is correctly signed, and then re-computing the SHA-1 of the entire message M, to verify that his computed hash matches Alice's hash H. If Eve can compute a "SHA-1 collision," Eve can make a fake package X (like, say, malware instead of a real software package) that has the same hash H as the message M that Alice has signed. With that, Eve can trick Bob into accepting her malware by presenting Bob with her fake message X and Alice's real signature S. This works, because Alice really did sign hash H, and X and M have the same hash; their signatures have "collided" with catastrophic results. To say that SHA-1 is "only broken for collisions" is to say that SHA-1 is broken for PGP. Anyway, I'm done here. I hope we both agree that you deserve PGP.

fanf2 6y ago
You are describing a second preimage attack, ie, Eve finds a colliding message that matches an existing message and hash generated by Alice. Not even MD5 is vulnerable to a second preimage attack. The actual problem with SHA-1 is that Eve can generate two different messages with the same hash, one innocuous and one malicious. If Eve can get Alice to sign the innocuous message then Eve can use the signature to attack Bob using the malicious message. Collisions are still catastrophic for most applications that use signatures, but it’s a wee bit harder to pull off an attack using pregenerated collisions than if you can find a second preimage. (Collision-based attacks need a signing oracle whereas second preimages do not.)

fanf2 6y ago

You are describing a second preimage attack, ie, Eve finds a colliding message that matches an existing message and hash generated by Alice. Not even MD5 is vulnerable to a second preimage attack. The actual problem with SHA-1 is that Eve can generate two different messages with the same hash, one innocuous and one malicious. If Eve can get Alice to sign the innocuous message then Eve can use the signature to attack Bob using the malicious message. Collisions are still catastrophic for most applications that use signatures, but it’s a wee bit harder to pull off an attack using pregenerated collisions than if you can find a second preimage. (Collision-based attacks need a signing oracle whereas second preimages do not.)