Re: IQ Handling vulnerabilities

Am 11.02.2014 17:17, schrieb Alexander Holler:
> Am 11.02.2014 16:33, schrieb Thijs Alkemade:

>>
>> You're not going to stumble upon a SHA-1 collision by accident. Even
>> if you do
>> "hashes of hashes". The esitmated cost of an intentional SHA-1
>> collision is
>> still at least $1M:
>> https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
>>
>> If you do happen to find one, congratulations, you are now famous.
>> Nobody has
>> published a SHA-1 collision yet.
>
> Sorry, but you haven't understood what I've written.

Just to be a bit more verbose, e.g. your proposal was to use

start = sha1(crytpo_rand())
start+1 = sha1(start)
...

id1 = start[0:10]
id2 = start+1[0:10]

which I interpret such, that, besides using a hash from hash (so no new 
source), the ID consists of just the first 10 characters of the 40 of a 
sha1. And then you argument with the collision rate of sha1?

Alexander Holler