Take a look at this https://z.cash/technology/history-of-hash-function-attacks.h...

bjornsing · on Feb 25, 2017

Interesting! :)

But isn't the real lesson here that X.509 is flawed?

Also, as the linked article says:

> The bottom line is that no widely-studied hash function has ever succumbed to a (second-)pre-image attack except for one.

And there are signatures that are provably resistant to collisions, shouldn't we move to such signatures?

pvg · on Feb 26, 2017

But isn't the real lesson here that X.509 is flawed

I don't think that's the case

And there are signatures that are provably resistant to collisions, shouldn't we move to such signatures?

It's just much simpler to move to a better hash function.

bjornsing · on Feb 26, 2017

> It's just much simpler to move to a better hash function.

I don't see how one excludes the other. :P