Exercise 1: Second-Preimage Resistance vs. Collision Resistance — Possible Solution
====================================================================

Second-preimage resistance: you're given ONE SPECIFIC input (M1)
already. The property says nobody should be able to find a different
input (M2) that produces the same hash as this particular M1. The
target input is fixed in advance.

Collision resistance: NEITHER input is fixed in advance. The property
says nobody should be able to find ANY two different inputs (M1 and
M2, both freely chosen by the attacker) that happen to produce the
same hash as each other. The attacker gets to search over pairs, not
just find a match for one specific fixed target.

This difference is exactly why collision resistance is strictly
harder to defend and needs the birthday-paradox math the chapter
describes -- searching over all POSSIBLE PAIRS of inputs is a much
larger search space than searching for a match to one fixed input.

Concrete example scenario for EACH property:

SECOND-PREIMAGE ATTACK SCENARIO: A software vendor publishes a
legitimate installer file along with its SHA-256 hash so users can
verify integrity. A second-preimage attack would mean an attacker
crafting a malicious installer file that produces that EXACT SAME
published hash, so users who check the hash are fooled into thinking
the malicious file is the legitimate one. The legitimate file's hash
is the fixed, known target here.

COLLISION ATTACK SCENARIO: A certificate authority signs a digital
certificate by hashing its content. A collision attack (like the real
Flame malware's MD5 collision, mentioned in the chapter) means an
attacker crafts TWO DIFFERENT documents -- say, a harmless-looking
certificate request and a malicious one -- that happen to produce the
same hash as each other. The attacker gets the harmless one signed
first, then swaps in the malicious one, which carries a valid
signature for a hash it was never actually meant to have. Neither
document was a pre-existing fixed target; the attacker had freedom to
construct both.

WHY THIS WORKS AS AN ANSWER
------------------------------
The key distinguishing detail -- "given a fixed input" vs. "no input
fixed in advance, search over pairs" -- is exactly what the chapter's
own definitions state, and the two scenarios map directly onto the
chapter's own MD5 case study: the 2004 collision attacks used the
freedom to construct BOTH inputs, which is precisely a collision
attack rather than a second-preimage attack against some pre-existing
fixed file.