How is it possible to detect "unknown SHA-1 cryptanalytic collision attacks given just a single file from a colliding file pair"?

Question

The following description from http://shattered.it caught my eye:

How do I detect this attack?

You can use the online tool above to submit files and have them checked for a cryptanalytic collision attack on SHA-1. The code behind this was developed by Marc Stevens (CWI) and Dan Shumow (Microsoft) and is publicly available on GitHub.

It is based on the concept of counter-cryptanalysis and it is able to detect known and unknown SHA-1 cryptanalytic collision attacks given just a single file from a colliding file pair.

I know basically nothing about cryptography, so I don't really know the full meaning of the phrase SHA-1 cryptanalytic collision attacks. The way I read the description, it states that I can analyze an arbitrary file on my hard drive and be told whether that file has been the target of a collision attack. If that is the case and if the tool's only knowledge of the world is the contents of my file, I can't see how such a thing could be possible.

I'm hoping someone can explain, in (relatively) simple terms, why my understanding is wrong or how this is actually possible.

Answer 1

The confusion comes from the following sentence:

I can analyze an arbitrary file on my hard drive and be told whether that file has been the target of a collision attack.

The attack does not target "harmless" files, and generate a collision for them: this would be a second-preimage attack, which is a much harder problem to solve. A collision attack simply produces a pair of files with a collision. But using the current known attack, the pairs produced that way have a very specific structure, which can be easily identified. So, if you check one of your files, it tells whether it has been generated during the process of this attack.

Of course, other attacks can exist, that we are not aware of yet, and the current checker would not be able to tell that your file does not come from such an attack. What it tells you is only whether your files were generated in the process of this particular attack. Another way of saying that is: we have no proof that no second preimage attack exists (even though we have no idea how to build such an attack), but if one existed, it would indeed allow to find collisions for arbitrary files, and so any of your files could have been the subject of an attack of this kind, but no software could see that from your file.