HNHacker News
TopNewBestAskShowJobs

jebed091

11 karma · joined October 8, 2015

submissionscomments
jebed091··on Freestart collisions for SHA-1
It's a collision if you can choose the IV. That's not much practical use, it's just an interesting demonstration that confirms research is slowly progressing towards a real collision.

SHA-1 uses a Merkle-Damgard construction, which means the input is split into fixed-size blocks and the output from one block becomes the IV for the next. This is because SHA-1 operates on a fixed-size, so if you have more than 1 block of data, it's chained together like this:

  char *SHA1(char *IV, char *block);

  Digest = SHA1(SHA1(SHA1(StartIV, block1), block2), block3);
A freestart collision is a collision if you can choose the IV. That's not much use, because we don't know how to find a block (or chain of blocks) that produce the IV we want.