From: Jon Seymour Date: Sun, 24 Apr 2005 22:25:32 GMT Subject: Whales falling on houses - was: Hash collision count Message-ID: <2cfc40320504241525c4153c2@mail.gmail.com> In-Reply-To: <68ff9fa6050424142416fbadcd@mail.gmail.com> .> > 1. Take your favorite text file, at least 160 characters long. > 2. Choose 160 positions in this file. > 3. For each position choose your favorite mispelling of that character. > 4. Produce all 2^160 text files, all of the same length, choosing for > each position either the original or the alternate character > 5. Add an arbitrary file of the same length, different from the above > > Two of these files have the same sha1 hash. Or, for that matter, for > any 160 bit hash the same is true. If you were to create those files at 10^9 files per second, it would take you 10^38 years before you were in position to take step 5. I am about to turn 38 this week. Would that I could live to 10^38. It's absolute rubbish to say that the best solution from an engineering point of view is to eliminate the infinitessimal possibility of a collision. Engineering is all about assessing risk and making suitable trade-offs. Every day of the week, "real" engineers accept life-threatening risks that put thousands of peoples lives in danger. They do it because we live in a world where risk cannot be eliminated, merely reduced to an acceptable level. I can't understand that you are a prepared to drive a car or fly in a Boeing or Airbus that has a demonstrated risk of killing you, yet you want to insist on eliminating a risk that at most might create an interesting Slashdot headline: "Jolt-crazed programmer finds SHA1 collision - but later dies when whale falls on house". jon. -- homepage: http://www.zeta.org.au/~jon/ blog: http://orwelliantremors.blogspot.com/