What would the implications be of a single randomly discovered SHA-256 collision?

Question

Imagine if someone messing around with hashes accidentally came across two inputs to SHA-256 that produced the same output. Not a concerted effort, not Google/NSA or crypanalysis. No tin foil hats. Just random chance in say a high school. And they made the two inputs public knowledge. Whilst highly improbable, not mathematically impossible. And just that one collision.

What would be the implications? Would people simply say "Well it had to happen someday" and carry on as normal, keeping the hash as is? Or would SHA-256 have been "broken" and an upgrade sought?

An answer to Are there any well-known examples of SHA-256 collisions? suggests that it would be major. Even if it happen entirely by chance?

If detected and published, it would be major and cryptographers would be a lot more stunned than at the MD5 and SHA-1 collisions that have been reported. — Squeamish Ossifrage, May 02 '18 at 22:04
@SqueamishOssifrage Stunned, yes. And people would surely start research quests to get to the bottom of this to see if there is more to it than just luck and potentially an indicator for something – but if it indeed was simply found by chance (as Paul Uszak describes), I doubt anyone would go call SHA256 “broken” (until proven otherwise). After all, there be pigeons who like to cuddle. — e-sushi, May 02 '18 at 23:13
@e-sushi It may be that one could figure out a more general method for finding collisions by observing how the internal state of SHA256 evolves for the colliding messages. But this is all idle speculation. — Squeamish Ossifrage, May 02 '18 at 23:24
Adding to the on-hold reason explained above, I’ld kindly like to remind you of what the help center states (so that you don‘t clash into alike on-holds again): To prevent your question from being flagged and possibly removed, avoid asking subjective questions where… you are asking an open-ended, hypothetical question: “What if ______ happened?” — e-sushi, May 03 '18 at 03:29

forest · Accepted Answer · 2019-08-23T03:21:56.287

Your question is a contradiction. If it actually is randomly discovered, then there are no implications because it is, well, random. If it were truly the result of luck, then so what? But the more likely explanation is that SHA-256 is really, very badly broken. I personally would not believe that anyone came up with such a collision by chance without testing an enormous number of possibilities.

Note however that, due to the length extension attack, a single public collision could be used to make more collisions with the same prefix. This could have security implications in practice. Additionally, if the collision came about through a non-generic attack against the hash itself, it may be possible to adjust it to find more collisions (see Luis Casillas's answer). This isn't the case if the collision was random.

Think of it another way. If I posted a list of all the passwords you have ever used online, and claimed I just got lucky and was posting random numbers from an RNG, would you believe it, or would you instead suspect that I had hacked your computer and was stalking you?

Your answer is a contradiction. You say if it is randomly discovered, then there are no implications, but in the second paragraph you say that you could use this collision for more collisions. — Nova, May 03 '18 at 22:33
@Nova I meant that there are no implications to the understanding or progress of cryptography, but there may be practical implications. I suppose I should have been more clear. — forest, May 03 '18 at 22:42

Luis Casillas · Answer 2 · 2018-05-03T21:07:51.353

6

It's possible that more collisions would be found right away. The reason is that SHA-256 is an iterative hash function—it works by absorbing messages block by block into a finite state. Since the output of SHA-256 is the whole of its final state, the discovery of an output collision implies the discovery of a state collision (two input prefixes that lead to the same internal state). A state collision might allow the construction of many additional output collisions, depending on the details of the function (e.g., if the colliding message are the same length finding additional collisions is trivial, but if they're not, length padding in SHA-256 might make it difficult).

More generally, if we were faced with the fact that it had taken a lot fewer than $2^{128}$ trials to find a collision, it should profoundly shake our confidence on the conjecture that SHA-256 is collision-resistant. You say that it's "highly improbable," but that's a hypothesis, not a proven fact, and you're positing a scenario where we'd actually have strong (albeit inconclusive) evidence against that hypothesis.

edited May 03 '18 at 21:07

answered May 03 '18 at 01:50

Luis Casillas

14,468
2
31
53

6

Actually, finding more collisions would be trivial if the two colliding messages were (after padding) the same length; if the lengths differed, then appending the same additional text to the preimages would put different lengths in the final padded blocks, and hence not a collision. – poncho May 03 '18 at 02:48
So it would be categorised as "broken"? – Paul Uszak May 03 '18 at 12:55
@poncho: Right. I've corrected my answer. – Luis Casillas May 03 '18 at 21:07
2

@PaulUszak: What does "broken" mean, exactly? Finding a collision in itself doesn't prove that there exists an efficient collision-finding attack (a "break" in a strict sense), but again, it should shake your confidence that no such attack exists. – Luis Casillas May 03 '18 at 21:14

What would the implications be of a single randomly discovered SHA-256 collision?

2 Answers2