3 ms·
Your definition of "completely broken" is misleading. While it makes complete sense to use SHA-256 and beyond, a collision of two carefully constructed plainte
by insaneirish 13y ago
Your definition of "completely broken" is misleading.
While it makes complete sense to use SHA-256 and beyond, a collision of two carefully constructed plaintexts is not indicative of a general break in SHA-1. It is much more difficult to find a collision against a fixed plaintext and hash and ridiculously more difficult for that collision to produce non-gibberish, working code that compiles and creates a vulnerability.
- darklajid 13y agoI'm no expert, at all. Reading your list of complications though I wonder if the last one is really a problem? Hiding a vulnerability that doesn't look suspicious on first sight? Agreed. But hiding a vulnerability at all - if compiled without reading the source? Isn't that 'just' appending /* garbage */ or even code in IFDEFs? In other words: Is the last point really an issue or is it 'just' a collection against a fixed plaintext/hash?