Re: [saag] SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1

[Phillip Hallam-Baker <[e-mail]>]

On Tue, Jan 7, 2020 at 7:06 PM Peter Gutmann <[e-mail]>
wrote:

> Russ Housley <[e-mail]> writes:
>
> >https://eprint.iacr.org/2020/014
> >
> > SHA-1 is a Shambles - First Chosen-Prefix Collision on SHA-1 and
> > Application to the PGP Web of Trust
>
> I'd commented on this on the cryptography list, my thoughts were:
>
> -- Snip --
>
> An interesting paper has just appeared on the IACR e-print archive:
>
>   SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and
> Application to
>   the PGP Web of Trust
>
>   https://eprint.iacr.org/2020/014.pdf
>
> tl;dr: Attacks sped up by a factor of ~16 over previous work, chosen-prefix
> collision for ~$75k and 2 months effort.
>
> It's a long (32 pages) but interesting read.  The only thing I have a bit
> of
> an issue with is the conclusion:
>
>   SHA-1 signatures now offers virtually no security in practice
>
> It should really be "SHA-1 signatures where the attacker has two months
> time
> and tens of thousands of dollars (there are some cheaper options than
> $75k) to
> prepare a forgery offer no security in practice".
>

I think we can be fairly clear what the real risk is going to be and I am
working on this in the podcast (could not record it today because there
were roadworks outside the studio).

What will happen is

* Short term panic and lots of people explaining there is nothing to worry
about.
* Five to ten years of complacency.
* A successful attack on a significant target that did not transition but
proved profitable.

$75K will be $5K before long and don't discount the possibility that $75K
could be a profitable attack. I am sure that organized crime has noted the
Lehman etc insider trading frauds and started planting moles in the banks.
$75K would be nothing when they are looking to cash out $100 million. We
have observed very significant amounts being paid for zero day attacks.

Most likely attack targets will be Git repos and similar applications using
SHA-1 hashes internally. The Git project did raise itself from the usual
security negligence Torvalds projects suffer from. The IPv6 buffer overrun
guards he stripped out of the kernel because he didn't understand them in
his 'compiler masturbation' rant is a more likely source of security
breach. It speaks of a hostile work environment.