[BitTorrent] SHA-1 broken

Harold Feit - Depthstrike.com Administrator dwknight at depthstrike.com
Wed Feb 16 12:04:53 EST 2005

Hash: SHA1

For situations where multiple different hashes are available, such as
BT's segmented SHA1, a standard file-wide SHA1, MD5, CRC32 and
Edonkey's segmented MD4, if 2 or more are available to verify a file,
the amount of CPU time required to find a collision increases. With
each additional algorithm added, the amount of CPU time grows

Perhaps the current solution is to adopt more hash algorithm
extensions (md5sum, sha1 <this one is file-wide instead of BT's
segmented>, ed2k) for the torrent metadata as standard rather than
try to re-work the existing code to a different hash algorithm, since
finding a size-matched collision that is common to two different hash
algorithms is far more difficult than finding a collision in just

We can agree however that the difference between a same-sized piece
collision and a different-sized piece collision is significant in the
realm of BT file verification.

- -----Original Message-----
From: Bill Cox [mailto:bill at viasic.com] 
Sent: Wednesday, February 16, 2005 10:50 AM
To: BitTorrent at yahoogroups.com
Subject: RE: [BitTorrent] SHA-1 broken

> BitTorrent is a bit more secure about its overall use of SHA1 than
> just a basic hash since the hashed data has a known size. With that
> known size, the scope of data that can cause a colission is a LOT
> smaller.

Well... here's a dumb simple algorithm to hack a fedora core release
BitTorrent file, which uses the fixed size.

Find the file you wish to corrupt (there are VERY many that will do
all you want is a back-door).

Find a file no one uses in the piece containing the file you want to
corrupt.  This should be easy, as pieces are 1M byte.

Modify the target file, introducing your hack.  Then run this simple

while(SHA1(piece) != publishedValue) {
	unusedData ^= randomString();

This should produce a valid signature in about 2^69 itterations.
Obviously, hardware acceleration is required to make this practical.
However, I don't see how fixed piece size helps the security.


Yahoo! Groups Links


- -- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 265.8.8 - Release Date: 2/14/2005

- -- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 265.8.8 - Release Date: 2/14/2005

Version: PGP 8.0.3


Yahoo! Groups Links

<*> To visit your group on the web, go to:

<*> To unsubscribe from this group, send an email to:
    BitTorrent-unsubscribe at yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:

More information about the BitTorrent mailing list