When we consider the security of a cryptographic hash function with $n$ bit output, we simply say that it must have at least $\mathcal{O}(2^{n/2})$-time security against the (generic) collision attack due to the birthday attack / paradox.
When we talk about the attacks from an educative perspective, one needs to demonstrate good examples of the usage of the collision attack.
One attack example from Wikipedia based on the hash-and-sign paradigm
The usual attack scenario goes like this:
- Mallory creates two different documents A and B that have an identical hash value, i.e., a collision. Mallory seeks to deceive Bob into accepting document B, ostensibly from Alice.
- Mallory sends document A to Alice, who agrees to what the document says, signs its hash, and sends the signature to Mallory.
- Mallory attaches the signature from document A to document B.
- Mallory then sends the signature and document B to Bob, claiming that Alice signed B. Because the digital signature matches document B's hash, Bob's software is unable to detect the substitution.
Another one from our site: Squeamish Ossifrage's answer
I make three versions of a software package:
- the good one does what it is advertised to do which is something useful
- the bad one does something harmful noisily, like uploading credit card data to a bad place
- the sneaky one does something harmful quietly, like slowly making your screen look blurrier and blurrier over the course of a month, or silently disabling disk encryption
There's a sneaky catch: the good one and the sneaky one collide under MD5, but the bad one does not.
and in short, goes like this. The bad one is detected due to an incorrect hash, but the sneaky one survives since it has a hash collision with the good one.
What are other good attack examples that use the hash collision?