« Politicopia: Participatory Legislation | Main | v|100 Podcast Interview »
The SHA-1 Defense
SHA-1 has been officially cracked. So what?
Technically, it probably doesn’t mean much. Being able to produce a hash collision doesn’t mean that you can produce a meaningful collision. For example if you have a digitally signed contract for $100, you won’t be able to produce a contract for $100,000 that has the same signature—at least not yet.
What could be a problem are the legal challenges to SHA-1 based signatures on the basis of “reasonable” doubt. George Ou discuses these kinds of challenges and points to the MD5 defense:
A Sydney Magistrate threw out the digitally time stamped photos in a speeding ticket case because the Roads and Traffic authority failed to produce an expert to testify that its speed camera images were secure. The motorist’s defense lawyer took advantage of the courts ignorance and argued that the MD5 hashing algorithm was a discredited piece of technology and therefore the speeding photos were invalid. Never mind that the defense never proved any actual tampering by the police department or explained how hash collisions in MD5 could possibly be used to fake photographs, it didn’t matter because the judge was ignorant and the traffic authority was incompetent in their prosecution of the case. We lock people away for life with photographs and audio recordings all the time that have NO digital signatures but because a piece of police evidence used a less than perfect MD5 hashing algorithm in the digital signature the entire case was thrown out. With SHA-1 being officially cracked by Chinese researchers, the “MD5 defense” just became the MD5/SHA-1 defense.From » Putting the cracking of SHA-1 in perspective | George Ou | ZDNet.com
Referenced Mon Jan 22 2007 16:44:14 GMT-0700 (MST)
Posted by windley on January 22, 2007 4:44 PM
Comment from Pat Ekman at January 22, 2007 6:22 PM
Meaningful collisions may not be much more difficult than meaningless ones if the file format provides enough leeway. For example, a meaningful collision for MD5 (very closely related to SHA-1) is available at http://www.cits.rub.de/MD5Collisions/ in the form of two ps files, which are the same size and have the same MD5 hash but frighteningly different contents. While it is still a lot harder to break SHA-1 than it is to break MD5, it's certainly within the realm of the possible. And the attacks can only get better.
Comment from Ian Rae at January 23, 2007 7:29 AM
>you won’t be able to produce a contract for $100,000 that has the same signature—at least not yet
"Not yet" I wonder if ever. The odds of being able to change "$100" to "$100,000" seems vanishingly small. You would presumably need to make some other modifications in order to get a hash collision; the modifications must't keep the rest of the document meaningful. Sounds impossible, but I'm no cryptographer.
Comment from Carl Youngblood at January 24, 2007 11:16 AM
As Pat correctly states, many meaningful collisions have been demonstrated in MD5. In fact, from what my cryptography prof told me at the University of Washington, researchers have developed algorithms for causing MD5 collisions between pretty much any two documents by introducing subtle changes to them that don't significantly affect their meaning. I don't have trouble believing that the same may one day be possible with SHA-1.
Leave a comment
I encourage you to leave a comment below. Your email address will not be displayed on Technometria, but allows me to communicate with you directly. Your email address won't be displayed, but will be used to compute a MicroID for your comment.