Marc Stevens

It's definitely a neat demonstration that he can produce a collision for these favourable "neutral-bit" IV's relatively cheaply. I suppose the next steps are to find two inputs that produce favourable IV's, then repeat this process for those, and that seems like it's getting really close. Stevens actually already has the best near-collision in non-reduced SHA-1 I know about from this paper: http://marc-stevens.nl/research/papers/EC13-S.pdf I made a quick visualization of it here, it looks pretty cool: https://lock.cmpxchg8b.com/shatter/visualize.html?stevens=1 I also added the Shappening vectors: https://lock.cmpxchg8b.com/shatter/visualize.html?shappening=1 It's funny that they actually collide around R74, then he has to diverge again so that when you add the IV (part of the process of creating the IV for the next block) they collide.

Each new _unrelated_ SHA1 attack will need an update in SHA1DC. But it has to be truly unrelated, as the collision detection method is fairly robust. I recommend reading the original "Counter-cryptanalysis" paper [0] for details on how attacks work and how they can be mitigated (there is certain internal state in SHA1 that is used in all known attacks). BTW, this paper has an interesting anecdote: apparently Flame malware had exploited MD5 collisions using novel unpublished attack method... and yet it was detected by collision detector (section 3.2). Another example is that SHA-mbles attack, published 3 years after "Counter-cryptanalysis", was detected as well, with no required code changes. No, there is nothing "fundamentally incompatible" in the new SHA1DC method. After all, git came out in 2005, 11 years before SHA1 attacks were known, so it used regular SHA1. The collision detector was added in 2017 and nothing broke, because false positive chance is 2^-90 [1]. I have not heard of any new SHA1 collision results, but if they are based on no-difference differential paths, git has nothing to worry about. And if they are not, it may be possible to extend DC detector to seamlessly detect and prevent those attacks, and then only upgrade git clients, keeping backward and forward compatibility for data. Of course there is always a chance that someone will come out with all-new SHA1 preimage attack that cannot be detected without high rate of false positive, so it's prudent…

I don't know if "10 years" falls in your definition of "next few years". For a viable rogue CA attack, you need a chosen-prefix attack. Current best research (https://marc-stevens.nl/research/papers/EC13-S.pdf) shows it should take 2^77.1 SHA-1 compression calls to do a chosen-prefix attack. Say this is improved to 2^65 within the next 10 years. Right now a good GPU (AMD R9 290) can do 3 billion SHA-1 compression calls per second. Say Moore's Law continues for the next 10 years and that 10 years from now a GPU can do 20 billion SHA-1 per second. So 10 year from now, 100 high-end GPUs should be able to produce a rogue CA with colliding SHA-1 signature in 7 month of compute time. Change one little assumption and assume the best attack ends up being 2^60 instead of 2^65. In this case, a viable attack could certainly be carried out in the next 3-4 years. You can't cross your fingers and hopes such an attack will not be discovered. The time to abandon SHA-1 is now.

Yes, the paper linked elsewhere in this thread introduced counter-cryptanalysis, for both MD5 and SHA1: https://marc-stevens.nl/research/papers/C13-S.pdf "Counter-cryptanalysis in principle enables the continued secure use of weak cryptographic primitives."

People are giving you shit, but people thinking about this sort of thing has yielded useful and interesting things like https://marc-stevens.nl/research/papers/C13-S.pdf Of course in production, just use sha256, but there is nothing wrong with thinking about unorthodox solutions.

I was curious about the “sha1dc” that git uses and reportedly helps protect against collision attacks. Here’s the paper: https://marc-stevens.nl/research/papers/C13-S.pdf

Create your own MD5 collisions – https://natmchugh.blogspot.cz/2015/02/create-your-own-md5-collisions.h… (2015, on HN here, but without any significant traction: https://news.ycombinator.com/item?id=9003429) The software used is "HashClash", seems it supports SHA1, too: https://marc-stevens.nl/p/hashclash/index.php

The paper is available at https://marc-stevens.nl/research/papers/SBKAM17-SHAttered.pdf

That's incredibly misleading. We don't care about the likelihood of producing some random collision; we care about the likelihood of producing some specific collision (which is not vulnerable to the birthday attack). http://en.wikipedia.org/wiki/Preimage_attack The reason SHA-1 is considered insufficient is that it is cryptographically broken https://marc-stevens.nl/research/papers/PhD%20Thesis%20Marc%20Stevens%… I.e. the chance of finding a collision is substantially higher than would be expected from an ideal PRF. As far as I know, there are no serious cryptanalytical attacks on RIPEMD-160, and 160 bits is more than sufficient for cryptographically unique identifiers.

To out-pedant you: even assuming that the differential collision attacks we know about are incorrect [1], we absolutely know how to break SHA-1 given enough compute, that is, roughly the same resources needed to break RSA-1024. The answer is generic collision finding with parallel rho [2]. [1] https://marc-stevens.nl/research/papers/EC13-S.pdf [2] http://people.scs.carleton.ca/~paulv/papers/JoC97.pdf

> the complexity involved in finding a collision for a specific hash If it can be shown that a preimage collision can be computed in less time than an exhaustive search, the algorithm is generally regarded as having a weakness, even if the given "less time" is still a very very long time. The theoretical complexity of MD5 is 2^128, but a preimage attack was discovered in 2009 which showed that a collision can be found in 2^123.4. [1] Collision attacks against MD5 have become more practical, there are even frameworks for it [2]. The complexity of 2^123.4 still makes a preimage attack against MD5 computionally unfeasible, but given that it's been shown to be weaker than its theorerical 2^128, it's possible that MD5 has other weaknesses which would allow the complexity to be reduced to a level that is computationally feasible. [1] https://www.iacr.org/archive/eurocrypt2009/54790136/54790136.pdf [2] https://marc-stevens.nl/p/hashclash/

> First off, because you simply don't have that ability in SHA-2 or SHA-3. If you're designing a new system, don't use MD5 or SHA-1; Then don't mention MD5 and SHA1 in the first place. The sooner they leave everyone's mind as valid alternatives the better. > For binary formats like images and PDFs, it's easy to put a large amount of unrendered data in the file format that isn't visible in a viewer MD5 collisions have gotten much shorter in the past years [1]. > For program code, having a bunch of arbitrary data in the middle of the function would look extremely suspicious. (Obviously you shouldn't design the metadata format of your functions to permit enough arbitrary data, And you trust the designers of these formats to know this "obvious" fact? You reference code normalization, but there was talk in this thread about keys that are to be associated with the functions to allow updates (and thus included in the hash) and I think it is perfectly valid to include graphics in the documentation of a function. > My argument is just that even the "broken" hashes really aren't very broken, so if you're using the non-broken ones, you should basically assume they're perfectly secure. My point is that this "structured collision resistance" is used far too often as a handwave argument why their specific protocol can continue to use a broken hash. (Remember how CAs said the same things about X.509 certificates before Appelbaum, Molnar et al. [2] presented an actual…