{"id":3582,"date":"2017-02-23T16:22:31","date_gmt":"2017-02-23T21:22:31","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=3582"},"modified":"2023-04-07T17:26:59","modified_gmt":"2023-04-07T21:26:59","slug":"sha-1-collision-created","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/sha-1-collision-created\/","title":{"rendered":"A SHA-1 Collision Has Been Created"},"content":{"rendered":"

But has this SHA-1 Collision truly broken SHA-1?<\/h2>\n

\u201cWe have broken SHA-1 in practice.\u201d<\/p>\n

That is the opening sentence on shattered.io<\/a>, the official website for the first practical demonstration of a collision with the SHA-1 hashing algorithm. The new research was a combined effort by Marc Stevens and Pierre Karpman of the CWI Institute in Amsterdam<\/a>, and a team from Google.<\/p>\n

A hashing algorithm is supposed to create a unique hash value for every file. That hash can then be used to compare and identify files. In some systems, a hash is used as a digital signature and computers rely on them to judge the authenticity of a file.<\/p>\n

“…there is much more to \u201cbreaking\u201d a hashing algorithm than just demonstrating a collision.”<\/strong><\/p><\/blockquote>\n

A collision is when two distinct files, made up of different bits, produce the same hash. This means that a computer comparing the hashes cannot identify one file from another, which attackers could use in a variety of attacks.<\/p>\n

In systems where hashes are used for secure purposes, this collision is now undeniable proof that SHA-1 is not safe to use.<\/p>\n

But while this is major progress on breaking SHA-1, this publication does not mean that a switch has been flipped and every SHA-1 hash is suddenly unreliable.<\/p>\n

The SHA-1 hashing algorithm has been known to be weak since 2005<\/a>. For the last few years many in the infosec community considered a SHA-1\u00a0collision to be imminent, and while that had yet to be proven, it was a serious enough concern that many fields sought stronger replacements. This spurred the SSL industry to start transitioning away from SHA-1 about 3 years ago.<\/p>\n

According to Valerie Aurora\u2019s \u201cReactions to stages in the life cycle of cryptographic hash functions<\/a>\u201d table, the first demonstration of a practical collision means it is now time to marvel at the technical feat of how it was done, but it\u2019s hardly a DEFCON situation.<\/p>\n

That\u2019s because there is much more to \u201cbreaking\u201d a hashing<\/a> algorithm than just demonstrating a collision. This is only the first in a series of demonstrations necessary to truly declare an algorithm broken, and then there is the practical matter of actually using these attacks.<\/p>\n

Because this is an identical-prefix attack, the current attack scenarios are very limited. In plain language, an identical-prefix attack requires that the attacker can produce, control, or influence both files: the \u2018original\u2019 and the collision. This means that creating a collision for an existing file, such as a third-party website\u2019s SSL certificate, is not yet feasible.<\/p>\n<\/span>\n

Even if the attack you had in mind worked with these restrictions, you have to be ready to deal with the cost. It took nine quintillion SHA-1 computations to produce a SHA-1 collision with the Shattered technique<\/a>. That\u2019s 9,223,372<\/strong><\/span>,036,854,775,808, the bolded red digit represents trillions, to put it in the\u00a0context of a big number we are familiar with.<\/p>\n

Crunching that many calculations requires a lot<\/strong> of computing power.<\/p>\n

There were two distinct phases to the technique, the first requiring 6,500 years of CPU compute time, and the second using 110 years of GPU time. If you were to use a cloud-computing service like Amazon Web Services, this amount of computational power would come with a 6-figure bill. That\u2019s all to produce a single collision.<\/p>\n

At that cost, creating a SHA-1 collision is not yet feasible for most organizations and people, and likely not worth it for many more who could foot the bill. Though that isn\u2019t to say it\u2019s totally out of reach for the top targets of nation states. Some governments have spent more than a million dollars on 0-days and other assets to attack political targets<\/a>, so it is feasible they could add this to their arsenal.<\/p>\n

\"SHA-1<\/p>\n

But most of us aren\u2019t hunted political activists. So, for everyday people and the infosec community, what does the Shattered collision really mean?<\/p>\n

For the SSL industry, luckily not much. Publicly-trusted SSL certificates have been using the SHA-256 hashing algorithm and that will be secure for many years to come. The most recent version of Chrome completely blocks all SHA-1 certs<\/a> from trusted roots, and Firefox has just announced it will immediately do the same<\/a> as a result of this collision.<\/p>\n

But other systems and software still use SHA-1, and those communities will now need to deal with the fact that a collision means realistic threats are now on the horizon. For instance, the GIT version control system uses SHA-1 hashes to identity repositories and commits. The email encryption<\/a> system PGP also heavily relies on SHA-1 signatures, and it is a common practice to print digests of PGP keys on business cards.<\/p>\n

While the Shattered collision is not likely to cause any harm tomorrow, it\u2019s a near-future risk that will require some major changes, and push some systems to move on to a new hashing algorithm for the first time in more than a decade.<\/p>\n","protected":false},"excerpt":{"rendered":"

But has this SHA-1 Collision truly broken SHA-1? \u201cWe have broken SHA-1 in practice.\u201d That is the opening sentence on shattered.io, the official website for the first practical demonstration of…<\/p>\n","protected":false},"author":2,"featured_media":3589,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[130],"tags":[668,507,131,667,666,156],"class_list":["post-3582","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-everything-encryption","tag-collision","tag-cryptography","tag-google","tag-hashing-algorithms","tag-identical-prefix-attack","tag-sha-1","post-with-tags"],"views":21171,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2017\/02\/iStock-473158924.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/3582","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=3582"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/3582\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/3589"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=3582"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=3582"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=3582"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}