3 ms·

So 10^15 H/s is about 2^50 H/s, or 2^71 H/Y. Assuming you could rededicate the whole network to attacking SHA-1 (which you practically couldn't, the ASICs woul

by ctz 13y ago

So 10^15 H/s is about 2^50 H/s, or 2^71 H/Y. Assuming you could rededicate the whole network to attacking SHA-1 (which you practically couldn't, the ASICs would need replacing) you could break 2^10 intermediate SHA-1 signed CA certs per year, and compromise the whole current deployment of HTTPS.

ISL 13y ago
Assuming that the hashes are equivalent difficulty (I don't know if they are): Given that the market cap of Bitcoin is ~$1B, imagine what you could do if you had ~$1-200M and wanted to crack some certificates...
- antocv 13y ago
  And now we know how NSA "breaks the internet encryption", it is not through RDRAND, its by good old force. Its much more cost-effective to do things by force than trying to predict the future uses of some hardware with some special software.
p1mrx 13y ago
Your math suggests that you can break a certificate with 2^61 hash operations, but this page says 2^61 operations will only give you a collision: https://code.google.com/p/hashclash/ https://code.google.com/p/hashclash/ With the ability to generate collisions, it becomes easier to trick a CA into signing an evil certificate, but collisions don't help if you want to break someone else's certificate.
- mrb 13y ago
  By "break", ctz meant "create 2^10 certificates". Creating arbitrary intermediate CAs would indeed compromise the safety of HTTPS.
mrb 13y ago
1 bitcoin hash (2 SHA-256 hashes) is approximately equivalent to 3 SHA-1 hashes in terms of number of 32-bit operations, so you are off by a factor 3. But your point remains valid :)
agl 13y ago
p1mrx is correct - creating plain SHA-1 collisions shouldn't break the CA system. Even though it's believed that one can create an identical-prefix collision with that amount of work, after the MD5 Industries demo all CAs now inject at least 64 bits of randomness into the signed certificate. Thus the certificate that they actually sign isn't predictable and doesn't have an identical prefix. Technically what one needs to break is the target-collision-resistance of SHA-1, and that's standing up much better. For things like git, however, an identical-prefix SHA-1 collision would be a problem.

by ctz 13y ago

ISL 13y ago

Assuming that the hashes are equivalent difficulty (I don't know if they are): Given that the market cap of Bitcoin is ~$1B, imagine what you could do if you had ~$1-200M and wanted to crack some certificates...

antocv 13y ago
And now we know how NSA "breaks the internet encryption", it is not through RDRAND, its by good old force. Its much more cost-effective to do things by force than trying to predict the future uses of some hardware with some special software.

p1mrx 13y ago

Your math suggests that you can break a certificate with 2^61 hash operations, but this page says 2^61 operations will only give you a collision: https://code.google.com/p/hashclash/ https://code.google.com/p/hashclash/ With the ability to generate collisions, it becomes easier to trick a CA into signing an evil certificate, but collisions don't help if you want to break someone else's certificate.

mrb 13y ago
By "break", ctz meant "create 2^10 certificates". Creating arbitrary intermediate CAs would indeed compromise the safety of HTTPS.

mrb 13y ago

1 bitcoin hash (2 SHA-256 hashes) is approximately equivalent to 3 SHA-1 hashes in terms of number of 32-bit operations, so you are off by a factor 3. But your point remains valid :)

agl 13y ago

p1mrx is correct - creating plain SHA-1 collisions shouldn't break the CA system. Even though it's believed that one can create an identical-prefix collision with that amount of work, after the MD5 Industries demo all CAs now inject at least 64 bits of randomness into the signed certificate. Thus the certificate that they actually sign isn't predictable and doesn't have an identical prefix. Technically what one needs to break is the target-collision-resistance of SHA-1, and that's standing up much better. For things like git, however, an identical-prefix SHA-1 collision would be a problem.