3 ms·

If you want to be reassured then sure. My take from reading that is in 2016 there was practical collision attacks demonstrated, which would be amplified with sp

If you want to be reassured then sure. My take from reading that is in 2016 there was practical collision attacks demonstrated, which would be amplified with specialized hardware (compare to bitcoin mining). Btw cheers! I recall you from correspondence years ago regarding fuzz testing linux packages.

hannob 5y ago
> My take from reading that is in 2016 there was practical collision attacks demonstrated No such thing happened. You're likely referring to this paper quoted in Wikipedia: https://eprint.iacr.org/2016/374.pdf https://eprint.iacr.org/2016/374.pdf This is 1. not about SHA256, but about the truncated sha2 algorithms and, more important, 2. it's an attack on reduced-round versions of these algorithms. That's a common thing in cryptoanalysis to do. You're basically saying "we have no way of attacking the full algorithm, so let's build a version which is much less secure and try to attack that". That's a valid thing to do for research purposes, but it needs to be interpreted correctly. "I can break this massively weaker version of the algorithm" is very different from "I have shown a practical attack on the real algorithm".
- alophawen 5y ago
  Absolutely, you are correct - the papers does not describe SHA256 as broken, but it is one step of many on the path for SHA256 to become broken in the future - which is in reply to your earlier comment: > You're proposing to add extra complexity for some hypothetical scenario that is unlikely to happen
  - ttybird2 5y ago
    I do not believe that the practical demonstration of a sha1 collision by google contributed at all to any potential future break of sha256.
  - SAI_Peregrinus 5y ago
    > but it is one step of many on the path for SHA256 to become broken in the future I disagree. It's evidence that the given path is not fruitful for breaking SHA256 in the future. When numerous researchers worldwide have attacked a function, and only broken X out of N rounds, for X << N, and future research hasn't been able to improve X for years, that's pretty good evidence that the technique used isn't going to continue to apply for more rounds. The existence of a multi-billion dollar bug bounty for breaking SHA256 (Bitcoin) that's gone unclaimed for years is further evidence that it's quite strong.

hannob 5y ago

> My take from reading that is in 2016 there was practical collision attacks demonstrated No such thing happened. You're likely referring to this paper quoted in Wikipedia: https://eprint.iacr.org/2016/374.pdf https://eprint.iacr.org/2016/374.pdf This is 1. not about SHA256, but about the truncated sha2 algorithms and, more important, 2. it's an attack on reduced-round versions of these algorithms. That's a common thing in cryptoanalysis to do. You're basically saying "we have no way of attacking the full algorithm, so let's build a version which is much less secure and try to attack that". That's a valid thing to do for research purposes, but it needs to be interpreted correctly. "I can break this massively weaker version of the algorithm" is very different from "I have shown a practical attack on the real algorithm".

alophawen 5y ago
Absolutely, you are correct - the papers does not describe SHA256 as broken, but it is one step of many on the path for SHA256 to become broken in the future - which is in reply to your earlier comment: > You're proposing to add extra complexity for some hypothetical scenario that is unlikely to happen
- ttybird2 5y ago
  I do not believe that the practical demonstration of a sha1 collision by google contributed at all to any potential future break of sha256.
- SAI_Peregrinus 5y ago
  > but it is one step of many on the path for SHA256 to become broken in the future I disagree. It's evidence that the given path is not fruitful for breaking SHA256 in the future. When numerous researchers worldwide have attacked a function, and only broken X out of N rounds, for X << N, and future research hasn't been able to improve X for years, that's pretty good evidence that the technique used isn't going to continue to apply for more rounds. The existence of a multi-billion dollar bug bounty for breaking SHA256 (Bitcoin) that's gone unclaimed for years is further evidence that it's quite strong.