and Elie Bursztein with the help of Marc Stevens (CWI), Pierre - PowerPoint PPT Presentation

and Elie Bursztein with the help of Marc Stevens (CWI), Pierre Karpman (INRIA), Ange Albertini, Yarik Markov, Alex Petit-Bianco

Digest uniqueness 3171 AC03 B186 File 1 One-way function 42A9 1C4E 3CBE 2 File 2

Attacking hash functions Finding a SHA-1 collision Post-collision world

https://shattered.io

Attacker file 1 Attacker file 2 3713ACE30E7ABBA https://shattered.io

Unknown file Attacker file 42ACE13F0E93BAD https://shattered.io

Known file Attacker file BAD37ACE308E93D https://shattered.io

https://shattered.io

Bruteforce is impractical Cryptanalysis to the rescue

File File File 1st block 2nd block last block IV Hash SHA1compress() SHA1compress() SHA1compress() R.C Merkle - Secrecy, authentication, and public key systems (1979)

? + Message block F F F Chain value

? + Message Messages differential path block F F F Equation system Chain value

File 1 (block 1) ? File 2 (block 1) Near collision Near collision != != Collision Collision File 1 (block m) = File 2 (block m)

https://shattered.io

Collision blocks Fixed prefix (P) Arbitrary suffix (S) (C1) Collision blocks Fixed prefix (P) Arbitrary suffix (S) (C2) P==P and C1!=C2 and S==S

Specially crafted Specially crafted prefix prefix Collision blocks (C1) Collision blocks (C2) Partial Suffix displayed (S) Partial Suffix displayed (S) File 1 File 2

Collision blocks Fixed prefix (P1) Arbitrary suffix (S) (C1) Collision blocks Fixed prefix (P2) Arbitrary suffix (S) (C2) P1!=P2 and C1!=C2 and S==S

https://shattered.io

MD5 SSL certificate forgery

Victim certificate Rogue signing certificate Serial number Serial number Validity period Validity period Real cert Rogue cert domain name (* wildcard) RSA public key X509 extensions CA=TRUE RSA public key Netscape Comment X509 extension X509 extensions CA=FALSE Signature Signature

Collision resistance Preimage resistance Security Fixed prefix Chosen attack Security claim Best attack Claim 2 64 2 1 MD4 2 64 2 16 2 39 MD5 2 80 2 63 2 77 SHA-1

2. Compute 3. Develop 1. Craft file 4. Compute near-collision full collision prefix collision blocks attack 2015 2015 - 2016 2016 2017

PDF header PDF header JPEG header JPEG header JPEG comment JPEG comment length length length length 2 collision comment in comment Image 1 Image 2 File 1 File 2

Work in small batches ~1h Refactor code to be stateless Factory paradigm not map-reduce

Determine Craft non Find DV attack linear additional selection success path conditions conditions Write Compute Find Fix attack collision speed-ups solvability code

Final collision check (CPU) Work step by step Collision blocks (C1) Always try to work at the highest step Collision blocks (C1) Parallelized: One thread / one solution Base solution (CPU)

https://github.com/nneonneo/sha1collider https://shattered.io

PDF header JPEG start JPEG comment Fixed Comment length = 0x173 Comment length = 0x17F Collision block JPEG comment Visual Desync Variable Image parsed Image as comment

https://shattered.io

Transition plan slowly in the making

Leverage how collisions are created Only requires one file to detect collision Trivial Negligible false positives differences required for feasible attacks

Github.com JGit

Git 2.12.2 (Mar 2017)

~4.45%

MD 2 128 MD 2 128 2 128 Sponge 2 128 2 256 HAIFA

SHA-1 is dead Counter-cryptanalysis Hash diversity long live to as a means of as a safeguard for SHA-256 & SHA-3 detection the years to come