How We Created the First SHA-1 Collision and What it Means for Hash Security

Presented at Black Hat USA 2017, July 26, 2017, 1:30 p.m. (50 minutes).

In February 2017, we announced the first SHA-1 collision. This collision combined with a clever use of the PDF format allows attackers to forge PDF pairs that have identical SHA-1 hashes and yet display different content. This attack is the result of over two years of intense research. It took 6500 CPU years and 110 GPU years of computations which is still 100,000 times faster than a brute-force attack.

In this talk, we recount how we found the first SHA-1 collision. We delve into the challenges we faced from developing a meaningful payload, to scaling the computation to that massive scale, to solving unexpected cryptanalytic challenges that occurred during this endeavor.

We discuss the aftermath of the release including the positive changes it brought and its unforeseen consequences. For example it was discovered that SVN is vulnerable to SHA-1 collision attacks only after the WebKit SVN repository was brought down by the commit of a unit-test aimed at verifying that Webkit is immune to collision attacks.

Building on the Github and Gmail examples we explain how to use counter-cryptanalysis to mitigate the risk of a collision attacks against software that has yet to move away from SHA-1. Finally, we look at the next generation of hash functions and what the future of hash security holds.

Presenters:

• Elie Bursztein - anti-fraud research lead, Google
  Elie Bursztein leads Google's anti-abuse research, which helps protect users against Internet threats. Elie has contributed to applied-cryptography, machine learning for security, malware understanding, and web security; authoring over fifty research papers in the field. Most recently, he was involved in finding the first SHA-1 collision. Elie is a beret aficionado, tweets at @elie, and performs magic tricks in his spare time. Born in Paris, he received a PhD from ENS-cachan in 2008 before working at Stanford University and ultimately joining Google in 2011. He now lives with his wife in Mountain View, California.

Links:

• https://www.blackhat.com/us-17/briefings/schedule/#how-we-created-the-first-sha-1-collision-and-what-it-means-for-hash-security-7693
• https://infocon.org/cons/Black Hat/Black Hat USA/Black Hat USA 2017/How We Created the First SHA-1 Collision and What it Means for Hash Security.mp4
• https://infocon.org/cons/Black Hat/Black Hat USA/Black Hat USA 2017/How We Created the First SHA-1 Collision and What it Means for Hash Security.en.transcribed.srt (subtitles)
• https://www.youtube.com/watch?v=Zl1TZJGfvPo

Similar Presentations:

• DEF CON 25 (2017) / How we created the first SHA-1 collision and what it means for hash security
• BSidesLV 2014 / SHA-1 backdooring and exploitation
• Black Hat Europe 2017 / Fed Up Getting Shattered and Log Jammed? A New Generation of Crypto is Coming