5

It was recently revealed that the SHA-1 hash algorithm has been broken

Several effected areas are detailed such as for example git and document signing. One thing that isn't mentioned is application integrity verification.

One application using SHA-1 for this is GnuPG. Even though they recommend to use an older version of gnupg to verify, the SHA-1 hash is used in case of new installs.

I'm asking what is the risk that compromised gnupg installs exist in the wild. With for example backdoors programmed in.

It is mentioned in the blog posts that no occurrences of this hack have been seen before in practice but would it not be possible that larger organizations have been working on this before the time frame of 2 years as the researchers have, and have therefore revealed this security flaw earlier?

|improve this question
5

Third party package repositories are vulnerable

There are two subtlely different contexts for this question. One is vulnerable and the other isn't.

  • If the application developer generates their own hash, this is still safe.
  • If there is a third-party repository, that accepts software from other developers, this is not safe.

This may seem a bizarre distinction. What is going on?

Secure hashes have two key properties:

  • Pre-image resistance - if you have a hash, you can't find the plaintext that generates that hash.
  • Collision resistance - you can't find two plaintexts that hash to the same value.

When an application developer generates their own hash, you are only relying on the first property for security. For a hacker to create malicious software that matches the legitimate hash, they would have to find a pre-image.

But with a third-party package repository you are relying on the second property. An attacker could create two bits of software: one benign, the other malicious - and craft them to cause a collision, i.e. they create the same hash. The attacker would submit the benign package to the repository, but then attack users with the malicious version.

It turns out that collision resistance is easier to defeat than pre-image resistance. The recent announcement only affects collision resistance. SHA-1 is thought to be secure against pre-image resistance.

|improve this answer
  • Thanks for the answer! I have a follow up question. Isn't it trivial for someone else than the developer to find the pre-image if we are working with open source software? Meaning that a malicious copy could be distributed by someone other than the developer without his knowledge? – Sparx Feb 23 '17 at 19:35
  • 2
    @Sparx - You're right, you could find the legitimate pre-image using some out-of-band technique, like downloading open-source. But what you can't do is modify that to make it malicious, while keeping the hash value the same. The process to generate a collision relies on being able to modify both images, and in that scenario you can only modify one of them. – paj28 Feb 23 '17 at 23:19
  • The way I understand the SHA-1 collision, the authors of the paper had 2 PDF files, one benign and one evil. They managed to make the hashes match through this attack. Doesn't that mean that even if the benign author generates his hash himself, an attacker could still develop a program with the same hash but different result that can be swapped out for the benign program? Or am I misunderstanding what you mean by Pre-Image resistance? – Nzall Feb 24 '17 at 14:11
  • 2
    @Nzall They could do that because they had the ability to modify both files to make the hashes match. This is what a collision is...The attacker controls both inputs. If you're trying to create a file with a hash that matches the hash of an existing file that you had no control over, (like an existing benign file someone else created) that is a second pre-image attack, which is a much harder problem, and one that cannot be solved currently, even for hash algorithms much weaker than SHA-1. So, if the attacker doesn't have control over both inputs to be hashed, a collision is not useful. – Xander Feb 24 '17 at 19:01
  • @Xander ok I think it makes more sense now. It's not totally intuitive that one of those would be simpler, but I can still imagine that to be the case. Thanks for the clarification. – Sparx Feb 24 '17 at 22:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.