Re: [9fans] Venti security in view of SHA-1 exploit

[Karl Magdsick <kmagnum@gmail.com>]

Note that the work factor is 2**69, being compared to 2**80 (birthday
attack).  In other words, SHA-1 is still believed to be weakly
collision resistant.  In other words, it still takes an attacker on
the order of 2**160 operations to find a collision between two blocks
if one of the blocks is pre-determined.

Strong collision resistance implies weak collision resistance and
you'd prefer a strongly collision resistant hash function.  A
demonstration that SHA-1 is not strongly collision resistant means
researchers are closer to demonstrating that SHA-1 is not weakly
collision resistant.  However, for fossil, you only need weak
collision resistance for most applications.

If you're worried about an attacker being able to create one file and
give it to you and being able to corrupt it later, then worry.

This attack does not seem to have direct implications for most
applications of fossil.

The sky isn't falling.  You'll probably want to start thinking about
changing hash functions once other hash functions start getting more
scrutiny as researchers start debating SHA-1 replacements.  The SHA-2
family (SHA-224,SHA-256,SHA-384, and SHA-512) have structure similar
to eachother, but perhaps different enough from SHA-1 to not be
vulnerable.  In any case, it would be brash to change hash functions
any time soon.


-Karl


On Sun, 20 Feb 2005 10:21:16 +1100, Bruce Ellis <bruce.ellis@gmail.com> wrote:
> from slashdot
>
> "Using a modified DES Cracker, for the small sum of up to $38M, SHA-1
> can be broken in 56 hours, with current computing power."
>
> so there you go.
>
> brucee
>