SHA-1 – Why are text containers used for certificates?

Question

Why are researchers using text files to prove the successful collisions?

In the case of the first MD5 collisions I believe it was PostScript-files. In the case of the recent SHA-1 collision it’s PDF files. A PDF file is basically a container file that comprehends a lot of meta-data attached to the actual viewable data. I presume this complicated the things, not the user readable data itself (the “content” of the PDF the viewer cares about). PostScript sometimes is called the predecessor of PDF and is somewhat comparable.

Why are these kind of “containers” used?

Assumption: apparently there’s enough data next to the actual data we want to change, to do some bit flipping / tricks to generate a collision.

Is this true?

Answer 1

The PDF or PostScript is used so that the collision is made very graphic. It is a public relation tool.

Known collision attacks on hash functions like MD5 and SHA-1 have some restrictions: the attacker can choose most of the colliding pair of messages, but the two blocks where interesting things occur are essentially random, and they will differ by only a few bits. The remainder of the colliding messages will be the same for both messages. So, as plain text, these blocks will be definitely non-pretty, and that's where the collision occurs. Thus, a plain ASCII text demonstration of the collision will not be "convincing" except for cryptographers.

Use of PostScript or PDF allows to leverage that small difference into arbitrarily spectacular differences; basically, the attacker can choose two completely different graphical contents for the whole page.

When the first collisions on MD4 were published, Dobbertin made the effort of making a sort-of ASCII text demonstration. His colliding pair consists in:

********************
CONTRACT

At the price of $176,495 Alf Blowfish sells his house to Ann Bonidea. ...

and:

********************
CONTRACT

At the price of $276,495 Alf Blowfish sells his house to Ann Bonidea. ...

in which the "*****" are twenty ugly-looking bytes that the attacker will claim to be there "for security reasons". MD4 is sufficiently broken that Dobbertin could make a demonstration with such mostly ASCII text, but he still had to include bytes that do not map to meaningful ASCII text.