3 ms·
<i>However, if you have for example a federated system you don't have a central instance issuing identifiers for objects. So you create a hash. In reality it do
by blincoln 5y ago
<i>However, if you have for example a federated system you don't have a central instance issuing identifiers for objects. So you create a hash. In reality it doesn't matter if you used SHA1, MD5 or even a random identifier.</i>
But it <i>does</i> matter. Usually it's only a big problem in edge cases, but sometimes those edge cases are <i>extremely</i> important. TLS certificates use a hash as their identifier in a distributed/federated model like you describe. By generating collisions, one can submit a normal signing request to a trusted public CA, but then use the resulting signature with a second certificate that has malicious properties (being for a domain name belonging to someone else, having additional properties like it being trusted to sign other certificates, etc.).[1] This is why you can't get new MD5 or SHA1 certificates signed by public authorities anymore.
As you say, there is always going to be at least an infinitesimally small chance that two realistic inputs to the same hashing function will produce the same output, but IMO virtually any system that uses hashes as identifiers will have its security degraded in some way if it's practical to generate a collision.
<i> If you program carefully such that you never overwrite another object if you update your object you'll get an internal error if you have a hash collision.</i>
It sounds challenging to handle this gracefully in a distributed system without some fairly complex logic. Alice uploads a PDF of sensitive data that hashes to value A on node 1. Node 1 grants Alice full access to the file with that hash. Bob uploads some meeting notes that also hash to value A, but on node 2. Node 2 grants Bob full access to the file with that hash. When the nodes are synchronized an hour later, the system detects a collision. What does it do?
[1] https://www.win.tue.nl/hashclash/rogue-ca/ https://www.win.tue.nl/hashclash/rogue-ca/