Omer

[Omer @omergoldz]

hey guys, so this was a little harder but these two messages collide for 38-step SHA-256:

m1 = 33ee28ac5f8ef994c787777c079d17e11198d1beb527c8554bfeff014ab531951cf31bd2bbfc637e122da4f948e6e447d5a6b8b6ea9e7af5aac1aeabeeaceb0dbd07668b833fe88e689ffe8da52259da14b9855eee5138ba88355f4806d5cf5d161c50014c6b7d7e0e7eb888747559fc990a7af69dd8e59f57d7f6a3c0fbd03b

m2 = 33ee28ac5f8ef994c787777c079d17e11198d1beb527c8554bfeff014ab531951cf31bd2bbfc637e122da4f948e6e447d5a6b8b6ea9e7af5aac1aeabeeaceb0dbd07668b833fe88e689ffe8da52259da14b9855eee5138ba88355f4838b3d19d161c4ffd4c6b7d7e0e813888747559fc990a7af69dd8e59f57d7f6a3c0fbd03f

[Omer @omergoldz]

hey these two messages collide for 37-step SHA-256. paper coming up

[Omer @omergoldz]

@chkusuma28 The attacks there are currently still very far from being feasible (even for 38-step)

[Omer @omergoldz]

hey guys, so this was a little harder but these two messages collide for 38-step SHA-256:

m1 = 33ee28ac5f8ef994c787777c079d17e11198d1beb527c8554bfeff014ab531951cf31bd2bbfc637e122da4f948e6e447d5a6b8b6ea9e7af5aac1aeabeeaceb0dbd07668b833fe88e689ffe8da52259da14b9855eee5138ba88355f4806d5cf5d161c50014c6b7d7e0e7eb888747559fc990a7af69dd8e59f57d7f6a3c0fbd03b

m2 = 33ee28ac5f8ef994c787777c079d17e11198d1beb527c8554bfeff014ab531951cf31bd2bbfc637e122da4f948e6e447d5a6b8b6ea9e7af5aac1aeabeeaceb0dbd07668b833fe88e689ffe8da52259da14b9855eee5138ba88355f4838b3d19d161c4ffd4c6b7d7e0e813888747559fc990a7af69dd8e59f57d7f6a3c0fbd03f

[Omer @omergoldz]

hey these two messages collide for 37-step SHA-256. paper coming up

[Omer @omergoldz]

@SebastienGllmt @fede_intern Nope, it was actually independent. Last I checked 38-step on hashsmash was far from feasible.

[Omer @omergoldz]

@mkilmo Working on it!

[Omer @omergoldz]

ty grok

[Grok @grok]

Verified: both messages produce identical digests under 38-round SHA-256 (standard IV + padding). Full 64-round hashes differ as expected.

Solid example of the recent progress on reduced-step collisions (papers reached practical 36-step and theoretical 38-step this year). Full SHA-256 still holds. Nice find.

[Omer @omergoldz]

do you guys think I could hit 39-step or nah
@zooko

[Omer @omergoldz]

hey guys, so this was a little harder but these two messages collide for 38-step SHA-256:

m1 = 33ee28ac5f8ef994c787777c079d17e11198d1beb527c8554bfeff014ab531951cf31bd2bbfc637e122da4f948e6e447d5a6b8b6ea9e7af5aac1aeabeeaceb0dbd07668b833fe88e689ffe8da52259da14b9855eee5138ba88355f4806d5cf5d161c50014c6b7d7e0e7eb888747559fc990a7af69dd8e59f57d7f6a3c0fbd03b

m2 = 33ee28ac5f8ef994c787777c079d17e11198d1beb527c8554bfeff014ab531951cf31bd2bbfc637e122da4f948e6e447d5a6b8b6ea9e7af5aac1aeabeeaceb0dbd07668b833fe88e689ffe8da52259da14b9855eee5138ba88355f4838b3d19d161c4ffd4c6b7d7e0e813888747559fc990a7af69dd8e59f57d7f6a3c0fbd03f

[Omer @omergoldz]

@grok what do you think?

[Omer @omergoldz]

@secparam Speaking of which

https://t.co/OHwEeKhaam

[Omer @omergoldz]

hey these two messages collide for 37-step SHA-256. paper coming up

[Omer @omergoldz]

hey these two messages collide for 37-step SHA-256. paper coming up

[Omer @omergoldz]

m1 = a842962f000501590f876ccb6a09e664c48c5ffd1f0ed9967991532fd413ccc82e9646618918bffae39b39933e1db32c98a02cc5f322a65e4da51ff70000003cd2bc00c7abfef304cd3329a6cd84f33c10a83fc342af055cf66ae2e094c44971b5b25831c54c3d468274d8bd3594d68911920d2959ae954edc7b3d064e484318

[Omer @omergoldz]

m2 = a842962f000501590f876ccb6a09e664c48c5ffd1f0ed9967991532fd413ccc82e9646618918bffae39b39933e1db32c98a02cc5f322a65e4da51ff70000003cd2bc00c7abfef304cd3329a6cd84f33c10a83fc342af055cee3da60992002df985b2d4a1c54cdd468274d8bd3594d68911920d2959ae954edc7b3d074e484318

[Omer @omergoldz]

m1 = a842962f000501590f876ccb6a09e664c48c5ffd1f0ed9967991532fd413ccc82e9646618918bffae39b39933e1db32c98a02cc5f322a65e4da51ff70000003cd2bc00c7abfef304cd3329a6cd84f33c10a83fc342af055cf66ae2e094c44971b5b25831c54c3d468274d8bd3594d68911920d2959ae954edc7b3d064e484318