<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div><br class=""><blockquote type="cite" class=""><div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Can anyone provide a pointy-eared boss description of what a *freestart* collision is?</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""></div></blockquote><div><br class=""></div>The input to the inner layer of a hash function based on the Merkle-Damgard construction (which is used by SHA1) are</div><div>- a message block and</div><div>- a chaining value.</div><div><div><br class=""></div></div>For the first block there is no previous chaining value though and thus a fixed initialisation vector (IV) is used. <div class=""><br class=""></div><div class="">In a freestart collision an attacker can choose the IV.</div><div class=""><br class=""></div><div class="">That’s it.</div><div class=""><br class=""></div><div class="">All the best,</div><div class="">Philipp</div></body></html>