4 ms·
I had always wondered about that, but it seems unlikely an MD5 could ever be spoofed in such a way that would make any sense. I mean to say, you could find a h
by jakejake 15y ago
I had always wondered about that, but it seems unlikely an MD5 could ever be spoofed in such a way that would make any sense.
I mean to say, you could find a hash that would match an existing, let say, word document. But that wouldn't be a legit word document or anything - it would likely be some random character string. The chances of changing anything in a meaningful way or adding a payload seems practically impossible to me. Is that a false assumption on my part?
- bdonlan 15y agoIt is. The MD5 preimage attacks support arbitrary (non-common) prefixes and arbitrary common suffixes. With complex file format like a word document, it's easy enough to put a binary blob at the end of the file that doesn't affect how it looks to the user, and the content before that point can be whatever you want (as long as it's the same binary length, which is also easy enough to arrange).
- pronoiac 15y agoHuh. I hadn't known about the MD5 preimage attacks. I'd planned to use salted MD5 to generate nonces, possibly with HMAC. How unsafe is that?
- jakejake 15y agothat's pretty interesting, i had assumed that it would be fairly easy to create duplicate content with the same signature, but nearly impossible to make that content something usable.
- mrb 15y agoThere are no known "preimage attacks" against MD5. Only collision attacks. The term you are looking for is a "chosen prefix collision attack".
- mrb 15y ago3 years ago, an MD5 collision was exploited to allow the creation of a fraudulent CA certificate! http://www.win.tue.nl/hashclash/rogue-ca/ http://www.win.tue.nl/hashclash/rogue-ca/ Basically they could create HTTPS certificates for any domain (microsoft.com, gmail.com, etc) and it would be shown valid by the browser. So MD5 collisions really are useful in practical real-world attacks.
- robinhouston 15y agoOh goodness no, there are lots of practical attacks that would work if people still trusted MD5. For example, two self-extracting archives with the same MD5 that unpack to completely different contents: http://eprint.iacr.org/2004/356.pdf http://eprint.iacr.org/2004/356.pdf Two postscript files with the same MD5 that print different letters: http://web.archive.org/web/20071226014140/http://www.cits.rub.de/MD5Collisions/ http://web.archive.org/web/20071226014140/http://www.cits.ru... And plenty more as listed here by Peter Selinger: http://www.mscs.dal.ca/~selinger/md5collision/ http://www.mscs.dal.ca/~selinger/md5collision/