Is this one of those NFTs the kids are talking about?
this post was submitted on 25 Jul 2024
13 points (100.0% liked)
linuxmemes
21280 readers
988 users here now
Hint: :q!
Sister communities:
- LemmyMemes: Memes
- LemmyShitpost: Anything and everything goes.
- RISA: Star Trek memes and shitposts
Community rules (click to expand)
1. Follow the site-wide rules
- Instance-wide TOS: https://legal.lemmy.world/tos/
- Lemmy code of conduct: https://join-lemmy.org/docs/code_of_conduct.html
2. Be civil
- Understand the difference between a joke and an insult.
- Do not harrass or attack members of the community for any reason.
- Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
- Bigotry will not be tolerated.
- These rules are somewhat loosened when the subject is a public figure. Still, do not attack their person or incite harrassment.
3. Post Linux-related content
- Including Unix and BSD.
- Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of
sudoin Windows. - No porn. Even if you watch it on a Linux machine.
4. No recent reposts
- Everybody uses Arch btw, can't quit Vim, and wants to interject for a moment. You can stop now.
Please report posts and comments that break these rules!
Important: never execute code or follow advice that you don't understand or can't verify, especially here. The word of the day is credibility. This is a meme community -- even the most helpful comments might just be shitposts that can damage your system. Be aware, be smart, don't fork-bomb your computer.
founded 1 year ago
MODERATORS
It's actually quite similar. Non-fungible since only OP has the private key but easy to steal by just downloading the image (and cropping the key if you want).
Has anyone confirmed that signature? I think it's not possible to have the signature as a part of the data itself. Kinda chicken egg problem
Here you go:
(MD5 is not PGP, but impressive nonetheless)
I opened the comment section to ask if it was possible to have an image with its own hash.
Thanks.
It's using a combination of multicollision attacks against MD5 and sequences of groups of alternate blocks of data representing the alphabet encoded in a way compatible with the file format.
It's basically <[a+random]/[b+random]/[c+random]...> * (length of message). The random data is crafted by the attack tool so each block has the exact same effect on the MD5 hashing algorithm as it processes each block. You need to decide how many variable blocks you need and where and their encoding in advance. You encode the blocks so the randomness isn't visible in the final rendered file.
When you have that prepped, you compute the final hash, then at each block position you select the block representing the letter you want (and its associated random data). So then you can select letters matching the actual file hash value.
It only works against hash functions with practical multicollision attacks. Doesn't work on SHA256 and newer hashes.
I know some of these words. But I think I roughly understood the general idea. Thanks!
Tldr, modern hash algorithms process data in fixed size blocks. For MD5 you take 128 bits at a time.
The core function in a hash is a little scrambler function (permutation) that takes two different inputs and gives you a single output back.
So it starts with a fixed value built into the algorithm, and then scrambles the first block of the message with it. Then it takes that scrambled piece and mixes that with the next block of the message, then takes THAT scrambled piece and mixes it with the next block. And so on until the end of the message. The last scrambled piece is the hash value.
Collision attacks target that core function by figuring out how to tweak multiple messages so that their scrambler outputs "collide", ending up equal. So you can hash two tweaked messages and get the same hash value. These tweaks usually include a bunch of random looking bits to work.
Then for a multicollision we don't just do it for two messages. We do it for every letter in the alphabet. For a HTML document we encode something like a and repeat for every letter. Every letter gets a distinct random looking value. Then we have many documents with the same hash and one letter different. We can show you a hash and then pick which letter to present you with in the document. All of them checks out.
But then we repeat the attack. We add another whole alphabet right after the first one! Now we have a a. And because the second letter is in a different block, that works just fine! Adding a second letter don't change the first intermediate value, and you can attack the second intermediate value for the second letter separately. So you add the whole alphabet again (with new associated calculated garbage for every letter in the second position), and now after the second letter we have a new intermediate value which is the same regardless of which letter we pick in the second position.
So now we can independently pick a random letter in the first position and in the second position too! Every combination of two letters has the same hash because of the hidden calculated garbage after each letter!
Then we just repeat the multicollision attack on the whole alphabet over and over until your document is long enough to encode your message. And that message may include the document's own hash.
*whispers* I stole that signature from cryptostorms warrant canary: https://cryptostorm.is/canary.txt
How would I verify this signature
Type it in
OCR
I hid something in this image
I see that fifth puppy u aint slick
PGP? Surely you mean GnuPG.
(Open)PGP is the protocol, GPG is just one application that implements it.
Those names get really really confusing. I used GPG to use a PGP key. I get mixed up too much.
Right. OpenPGP is the protocol. PGP is the original app, which predates the spec.
Did you actually have to acksually this though? Every mom and their cat simply calls it pgp
PGP is a different piece of software though. Would you refer to Firefox as "Chrome" because both of them can use the same protocol (HTTP)?
This reminds me of my parents referring to every games console as a "PlayStation" lol
Except PGP is a substring of the 'technically correct' term. It's like someone saying you're playing on your Nintendo - "Um, actually it's a Nintendo 64."
Yeah, you're right. Who thought that it was a good idea to name two things that mean a similar thing PGP and GPG? It is so easy to use the wrong one..