and Elie Bursztein with the help of Marc Stevens (CWI), Pierre - - PowerPoint PPT Presentation

▶
and
SMART_READER_LITE
LIVE PREVIEW

and Elie Bursztein with the help of Marc Stevens (CWI), Pierre - - PowerPoint PPT Presentation

Aug 20, 2022 423 likes •966 views

and Elie Bursztein with the help of Marc Stevens (CWI), Pierre Karpman (INRIA), Ange Albertini, Yarik Markov, Alex Petit-Bianco Digest uniqueness 3171 AC03 B186 File 1 One-way function 42A9 1C4E 3CBE 2 File 2 Attacking hash functions

slide-1
SLIDE 1

Elie Bursztein

with the help of Marc Stevens (CWI), Pierre Karpman (INRIA), Ange Albertini, Yarik Markov, Alex Petit-Bianco

and

slide-2
SLIDE 2

2 42A9 1C4E 3CBE 3171 AC03 B186 File 1 File 2

Digest uniqueness One-way function

slide-3
SLIDE 3
slide-4
SLIDE 4

Attacking hash functions Finding a SHA-1 collision Post-collision world

slide-5
SLIDE 5

https://shattered.io

slide-6
SLIDE 6
slide-7
SLIDE 7

Attacker file 1 Attacker file 2

3713ACE30E7ABBA

https://shattered.io

slide-8
SLIDE 8

Unknown file Attacker file

42ACE13F0E93BAD

https://shattered.io

slide-9
SLIDE 9

Known file Attacker file

BAD37ACE308E93D

https://shattered.io

slide-10
SLIDE 10

https://shattered.io

slide-11
SLIDE 11

Bruteforce is impractical Cryptanalysis to the rescue

slide-12
SLIDE 12

Hash

R.C Merkle - Secrecy, authentication, and public key systems (1979)

SHA1compress() File 1st block

IV

SHA1compress() File 2nd block SHA1compress() File last block

slide-13
SLIDE 13

F

Message block Chain value

+ F F ?

slide-14
SLIDE 14

F + F F ?

Messages differential path Equation system

Message block Chain value

slide-15
SLIDE 15

Near collision Collision Collision

!=

File 1 (block m) File 2 (block m)

=

Near collision

!=

File 1 (block 1) File 2 (block 1)

?

slide-16
SLIDE 16

https://shattered.io

slide-17
SLIDE 17

Collision blocks (C1) Fixed prefix (P) Arbitrary suffix (S) Collision blocks (C2) Fixed prefix (P) Arbitrary suffix (S)

P==P and C1!=C2 and S==S

slide-18
SLIDE 18

Collision blocks (C1) Partial Suffix displayed (S) Collision blocks (C2) Specially crafted prefix Partial Suffix displayed (S) Specially crafted prefix

File 1 File 2

slide-19
SLIDE 19

Collision blocks (C1) Fixed prefix (P1) Arbitrary suffix (S) Collision blocks (C2) Fixed prefix (P2) Arbitrary suffix (S)

P1!=P2 and C1!=C2 and S==S

slide-20
SLIDE 20

https://shattered.io

slide-21
SLIDE 21

MD5 SSL certificate forgery

slide-22
SLIDE 22

Serial number X509 extensions CA=FALSE Validity period Real cert domain name Signature Signature RSA public key Netscape Comment X509 extension Serial number Validity period

Rogue signing certificate Victim certificate

X509 extensions CA=TRUE Rogue cert (* wildcard) RSA public key

slide-23
SLIDE 23
slide-24
SLIDE 24

Collision resistance Preimage resistance

Security Claim Fixed prefix Chosen attack Security claim Best attack

MD4 264 21 MD5 264 216 239 SHA-1 280 263 277

slide-25
SLIDE 25
slide-26
SLIDE 26
  • 4. Compute

collision

  • 3. Develop

full collision attack

  • 1. Craft file

prefix

  • 2. Compute

near-collision blocks

2015 2015 - 2016 2016 2017

slide-27
SLIDE 27

PDF header JPEG header

JPEG comment

Image 1 collision File 1

length length

File 2 PDF header JPEG header

JPEG comment

Image 2

length 2 length

comment in comment

slide-28
SLIDE 28

Work in small batches ~1h Refactor code to be stateless Factory paradigm not map-reduce

slide-29
SLIDE 29

DV selection Craft non linear path Determine attack success conditions Find additional conditions Fix solvability Find speed-ups Write attack code Compute collision

slide-30
SLIDE 30

Collision blocks (C1) Final collision check (CPU) Collision blocks (C1) Base solution (CPU)

Work step by step Always try to work at the highest step Parallelized: One thread / one solution

slide-31
SLIDE 31
slide-32
SLIDE 32
slide-33
SLIDE 33
slide-34
SLIDE 34

https://shattered.io

https://github.com/nneonneo/sha1collider

slide-35
SLIDE 35

Fixed PDF header Variable JPEG start Image parsed as comment JPEG comment JPEG comment Visual Desync Comment length = 0x173 Image Comment length = 0x17F Collision block

slide-36
SLIDE 36
slide-37
SLIDE 37
slide-38
SLIDE 38
slide-39
SLIDE 39
slide-40
SLIDE 40
slide-41
SLIDE 41
slide-42
SLIDE 42

https://shattered.io

slide-43
SLIDE 43

Transition plan slowly in the making

slide-44
SLIDE 44

Leverage how collisions are created Only requires one file to detect collision Negligible false positives

Trivial differences required for feasible attacks

slide-45
SLIDE 45

JGit Github.com

slide-46
SLIDE 46

Git 2.12.2 (Mar 2017)

slide-47
SLIDE 47
slide-48
SLIDE 48
slide-49
SLIDE 49

~4.45%

slide-50
SLIDE 50

MD MD 2128 Sponge 2128 2128 HAIFA 2128 2256

slide-51
SLIDE 51

SHA-1 is dead long live to SHA-256 & SHA-3 Counter-cryptanalysis as a means of detection Hash diversity as a safeguard for the years to come

slide-52
SLIDE 52
slide-53
SLIDE 53