While being fascinated by how it is possible to create hidden services with Tor, there's a few details around the address collision issue I can't seem to wrap my head around.
Quote from Hidden Service Names on the Tor wiki (my emphasis):
The output of SHA1 has a length of 160 bit. To make handling the URLs more convenient we only use the first half of the hash, so 80 bit remain. Taking advantage of the Birthday Attack, entropy can be reduced to 40 bit. That's why collisions could be found with moderate means. This is not a problem for Tor since all an attacker might be able to do is create two different public keys that match the same .onion name. He would not be able to impersonate already existing hidden services.
So if I were to trust only the address of a hidden service, how is it that it cannot be impersonated?
If two services had announced themselves with each their own public key, where both hash to the same address, how do I know which service is my intended one when I try to visit the address?
How, for that matter, is the destination decided? Will my onion proxy tell me that there are 2 services for this address, present each public key and ask me to choose?
If my service for some reason went down and another had announced itself, again its public key hashing to the same address, how do I know that this service is not the one I intend to visit? If I have visited it before, will my onion proxy warn me that the key has changed? What if I hadn't ever visited it?
It seems to me that in order to authenticate a service, it's not enough to trust its address, I need to obtain and trust its public key separately and in advance of looking up the service in the Tor network. Am I incorrect in this conclusion?
