A collision attack finds distinct inputs A and B whose hash digests match: H(A) = H(B). Every hash function is theoretically collision-prone, but it is considered broken when collisions can be found more efficiently than the birthday attack. section 6.5
The practical danger is logical divergence behind identical fingerprints. An attacker can exploit a file format’s comments, length fields, or parser behavior so two files share a digest while displaying or activating different contents. section 6.4.1 section 6.5
Two files, one digest
A collision block gives one file a short comment length and another a long length. Data A remains active in the first file, while the second hides it and enables Data B; both files hash identically. section 6.4.1
Equation 6.1
\[\begin{aligned} \begin{aligned} H(A) &= H(B) \\ H(A || X) &= H(B || X) \end{aligned} \label{equation:extend-collision} \end{aligned}\]The collision property extends through a shared suffix: if H(A) = H(B), then H(A || X) = H(B || X). section 6.4.1
Collision resistance also matters in message authentication. Secret-suffix MACs can let an attacker create different messages with the same tag when weak hashes such as MD5 or SHA-1 are used; HMAC is resistant to this attack. section 7.2
