Why were hash collisions unimportant?

Question

The IOTA devs have stated that Curl-p is not a cryptographic hashing function and one way collisions are not an issue for the usage in IOTA. (and of course, Curl-p is not even used for signing now so it is not currently relevant)

I understand that the attack vectors suggested by DCI are extremely far-fetched. They involve the attacker (Eve) generating two bundles with the same hash but different amounts, and then rely on Alice for some reason signing one of those bundles.

However I am trying to understand what prevents a similar attack where someone has re-used an address - although addresses 'shouldn't' be re-used, they obviously have been in many cases.

So for example,

1. Alice sends 100 IOTA from address A to Eve, signs and attaches the transaction.
2. Alice receives another 1Gi onto address A

My questions:

1. Eve knows the signature and the hash for the first transaction. What prevents Eve from generating another transaction to send 1Gi from address A to herself, twiddling the bits (trits?) until the transaction hash collides, then attaching that transaction?

2. What about if the first transaction was not sent to Eve but another random party, could an attacker easily generate a hash collision with a different output address, or does it rely on the transaction being very similar?

3. If a transaction was pending for a long time, would it be feasible for Eve to generate a collision and have a transaction confirmed before the original transaction is confirmed, without Alice ever receiving onto address A again?

4. Does an attacker even need to generate a full collision? It seems that with the one-time signature, they already know half of the private key, so, say it's only a little different, it would only need a 'small' amount of brute forcing to generate the rest of the private key.

I don't have any real background in cryptography, so I suspect there is something I'm missing which means that it's not as simple as this for an attacker. I would just like to understand better why a collision doesn't matter.

Answer 1

Curl-P is not use for signing transaction, therefore collisions in Curl-P is not relevant.

For question 1:

Eve can try to do it, but the probability to achieve this in reasonable time is extremely low.

For question 2:

Any bit change in signed data (the amount, the address,...) completely change the signature. It is not easier to brut-force an almost identical transaction than a completely different one.

For question 3:

Again, attacking an address with the knowledge of only one signature is practically impossible.

For question 4:

Eve knows 50% of the private and so can try to build a transaction with a hash very similar to the hash of the first transaction and brute-force the bits that are different. But once again, the probability to accomplish this in reasonable time is very low.

---

Note that as soon as Alice try to spend a second time from address A : the story is completely different because Eve knows more than 50% of the private key and it became drastically easier for her to generate a transaction hash matching the known portion of the private key. This leads to a race between Alice and Eve to be the first confirmed.

---

Why collisions in Curl-P aren't important ?

Curl-P remains in use just to do the POW (i.e. a useless computation challenge). In other words, today, Curl-P don't have any role regarding security of the funds.