4 ms·

Well, if you are that picky, then you will have to wait. MD5 was created in 1991, the first collision was found in 2004.

tptacek 3mo ago
You want to pick a date and make a bet?
- javcasas 3mo ago
  You are the one discarding every date. I'll take the opposite bet: it will eventually happen, on some date.
  - tptacek 3mo ago
    I haven't discarded any date. Pick one, and an amount to bet!
    - javcasas 3mo ago
      > OK, produce a SHA-2 collision. - Why a collision? > Because man made SHA-2, so it must be breakable. I don't dispute that there are systems humans make that are breakable (that would be weird given my career). Thus implying there are man-made systems that are not breakable, and furthermore SHA-2 is one of them. > I haven't discarded any date. Going back so quickly?
      - tptacek 3mo ago
        I'm sorry, you've lost me. I was responding to the claim that any man-made system was breakable. The most obvious example of a man-made system that is unlikely to be breakable in our lifetimes (so, I'll say, "ever") is SHA2. Then someone responded that SHA2 wasn't an interesting target. It doesn't have to be; it just has to be man-made, or concede the narrowing of the original claim.
        jrflowers 3mo ago
        lmao at substituting “ever” for “in our lifetimes” “That will never happen” and “I think I’ll die before that happens” aren’t interchangeable. Hydrogen will never have two protons, SHA-2 will be broken. “I personally don’t consider a future where I’m not around as existing” is like busting out an Uno reverse card when you lose a hand at poker
        tptacek 3mo ago
        This objection doesn't make sense in the context of the thread.
        akerl_ 3mo ago
        I wonder when Kalshi will start offering bets where one side doesn’t pay out until the end of the universe.
        jrflowers 3mo ago
        tptacek will clean up
        jrflowers 3mo ago
        It’s not an objection. Somebody said “[x thing] is impermanent” and the rebuttal you posted was “human life is also impermanent” That’s not really a rebuttal to the notion that everything is impermanent, that supports it. Anyway a wizened crone told me I’ll die on 11 September 2098, so let’s give me two weeks to gloat. Two weeks before that date. I will bet you that it happens on or before that date. Props for taking the over that no collisions of SHA-2 will happen before then
        akerl_ 3mo ago
        The danger of using quotation marks around things that aren't quotes is that you can wildly misstate what somebody said and readers are left to ponder if you just don't understand or if you're willfully trying to misrepresent them. The reason a bet on this would need a date other than "ever" is because if one side of the bet can't be resolved until infinite time has passed, it just doesn't make any sense.
tarpitt 3mo ago
Okay, so you are saying that there may be a design flaw we just haven't seen yet, based on historical precedent. Which is a very weak argument, because you are just making the case for the possibility that you may be correct, and you are just pointing to a historical precedent. Can you prove that there is no hash function that is not vulnerable? If anything man-made is vulnerable, then there cannot any invulnerable system. That is what you need to prove to win the argument. And if we can prove that any system is unbreakable, you are wrong.
- tptacek 3mo ago
  One frustration I have with these kinds of analyses on HN is that they're premised on an idea that cryptanalysis progress is unknowable, and that it's just a matter of time before whatever broke the last iteration of a design is going to break the next iteration of a design. As if cryptanalysis is so complex and forbidding that you might as well think of it as a geological-scale weather phenomenon. If anything, the opposite thing is true. Each of the MD4, MD5, and SHA1 results are essentially exploits of design weaknesses: iteration insufficiency, too much traceable control over state given message words, weak and linear message schedules. In the history of hash cryptanalysis, we continuously get better at exploiting these kinds of weaknesses, successfully exploiting differential analyses with smaller and smaller windows of opportunity (which is why SHA1 was such a big deal). But in the same way that you can foreclose entirely on a SQLI with parameterized query, or a memory corruption vulnerability with automatic bounds checking, you can also just make the message schedule (not understood in the era of MD4 to be that big a hinge point) strong and nonlinear. It is very unlikely that the future of CS holds some reliable way to defeat bounds checking, and, for the same reason, you can find cryptographers like JP Aumasson (a coauthor of BLAKE and BLAKE3, with no particular reason to stan the older NSA construction) saying we're unlikely to break SHA2... ever.

tptacek 3mo ago

You want to pick a date and make a bet?

javcasas 3mo ago
You are the one discarding every date. I'll take the opposite bet: it will eventually happen, on some date.
- tptacek 3mo ago
  I haven't discarded any date. Pick one, and an amount to bet!
  - javcasas 3mo ago
    > OK, produce a SHA-2 collision. - Why a collision? > Because man made SHA-2, so it must be breakable. I don't dispute that there are systems humans make that are breakable (that would be weird given my career). Thus implying there are man-made systems that are not breakable, and furthermore SHA-2 is one of them. > I haven't discarded any date. Going back so quickly?
    - tptacek 3mo ago
      I'm sorry, you've lost me. I was responding to the claim that any man-made system was breakable. The most obvious example of a man-made system that is unlikely to be breakable in our lifetimes (so, I'll say, "ever") is SHA2. Then someone responded that SHA2 wasn't an interesting target. It doesn't have to be; it just has to be man-made, or concede the narrowing of the original claim.
      - jrflowers 3mo ago
        lmao at substituting “ever” for “in our lifetimes” “That will never happen” and “I think I’ll die before that happens” aren’t interchangeable. Hydrogen will never have two protons, SHA-2 will be broken. “I personally don’t consider a future where I’m not around as existing” is like busting out an Uno reverse card when you lose a hand at poker
        tptacek 3mo ago
        This objection doesn't make sense in the context of the thread.
        akerl_ 3mo ago
        I wonder when Kalshi will start offering bets where one side doesn’t pay out until the end of the universe.
        jrflowers 3mo ago
        tptacek will clean up
        jrflowers 3mo ago
        It’s not an objection. Somebody said “[x thing] is impermanent” and the rebuttal you posted was “human life is also impermanent” That’s not really a rebuttal to the notion that everything is impermanent, that supports it. Anyway a wizened crone told me I’ll die on 11 September 2098, so let’s give me two weeks to gloat. Two weeks before that date. I will bet you that it happens on or before that date. Props for taking the over that no collisions of SHA-2 will happen before then
        akerl_ 3mo ago
        The danger of using quotation marks around things that aren't quotes is that you can wildly misstate what somebody said and readers are left to ponder if you just don't understand or if you're willfully trying to misrepresent them. The reason a bet on this would need a date other than "ever" is because if one side of the bet can't be resolved until infinite time has passed, it just doesn't make any sense.

tarpitt 3mo ago

Okay, so you are saying that there may be a design flaw we just haven't seen yet, based on historical precedent. Which is a very weak argument, because you are just making the case for the possibility that you may be correct, and you are just pointing to a historical precedent. Can you prove that there is no hash function that is not vulnerable? If anything man-made is vulnerable, then there cannot any invulnerable system. That is what you need to prove to win the argument. And if we can prove that any system is unbreakable, you are wrong.

tptacek 3mo ago
One frustration I have with these kinds of analyses on HN is that they're premised on an idea that cryptanalysis progress is unknowable, and that it's just a matter of time before whatever broke the last iteration of a design is going to break the next iteration of a design. As if cryptanalysis is so complex and forbidding that you might as well think of it as a geological-scale weather phenomenon. If anything, the opposite thing is true. Each of the MD4, MD5, and SHA1 results are essentially exploits of design weaknesses: iteration insufficiency, too much traceable control over state given message words, weak and linear message schedules. In the history of hash cryptanalysis, we continuously get better at exploiting these kinds of weaknesses, successfully exploiting differential analyses with smaller and smaller windows of opportunity (which is why SHA1 was such a big deal). But in the same way that you can foreclose entirely on a SQLI with parameterized query, or a memory corruption vulnerability with automatic bounds checking, you can also just make the message schedule (not understood in the era of MD4 to be that big a hinge point) strong and nonlinear. It is very unlikely that the future of CS holds some reliable way to defeat bounds checking, and, for the same reason, you can find cryptographers like JP Aumasson (a coauthor of BLAKE and BLAKE3, with no particular reason to stan the older NSA construction) saying we're unlikely to break SHA2... ever.