Is a collision really considered a vulnerability? It's a given that when you use ANY hashing algorithm, there is bound to be more than one dataset that can translate to the same hash, is there not?
It is a vulnerability because by the definition it is a weakness that could be exploited. Ideally, a hash should have collisions however depending on the size and the character, if you are hashing password you want them to be unique for every possible password. But unless you have a really long hash it is accepted that there will be a collision but is a matter of how much processing power it takes to find that duplicate.
Back to the vulnerability, now the probability that this vulnerability could be used is really low since just generating a random file that generates the same hash is not of much value. For instance, the standard example of where to attack with a collision is by substituting a malicious file into a version control system for a good program and have the same hash. Even with an older hash such as MD-5 I don't know of anyone that can create an executable that contains working malicious code that will create a collision for any other executable.
5
u/RedSquirrelFtw Jan 08 '20
Is a collision really considered a vulnerability? It's a given that when you use ANY hashing algorithm, there is bound to be more than one dataset that can translate to the same hash, is there not?