4 ms·

In a deep voice: Your wish is my command. https://gist.github.com/skull-squadron/8f806b28abbcaa1ba9c256391e5bd8f9 https://gist.github.com/skull-squadron/8f806b

In a deep voice: Your wish is my command. https://gist.github.com/skull-squadron/8f806b28abbcaa1ba9c256391e5bd8f9 https://gist.github.com/skull-squadron/8f806b28abbcaa1ba9c25... Unfortunately, it may take several years before a certain TOTP value is reached because the values are nondeterministic rather than ordered and so there will be hash collisions of other values as well. Example: JBSWY3DPEHPK3PXP 999999 TOTP will match 999999 between 2024-11-29 16:37:00 -0600 and 2024-11-29 16:37:29 -0600

landgenoot 2y ago
The community here keeps impressing me. Nice job! Yes it could be several years, however the expected value is less than a year. Just like the expected dice rolls before rolling 6 is 6.
- hi-v-rocknroll 2y ago
  Yes, it's good to disambiguate that it's expected in a statistical sense but it's not an upper bound or confidence interval. I also wrote a program to find CRC32 hash collisions that can be injected into a text file or script to make a text hash to that value. https://gist.github.com/skull-squadron/c85d295cf9e6124dd7e90716dc7b7310 https://gist.github.com/skull-squadron/c85d295cf9e6124dd7e90... Doing so MD5, SHA1, or even SHA256 would be extremely slow and expensive, but not impossible.
  - nayuki 2y ago
    You don't need to brute-force CRC-32. I do a preimage attack directly using linear algebra: https://www.nayuki.io/page/forcing-a-files-crc-to-any-value https://www.nayuki.io/page/forcing-a-files-crc-to-any-value
    - hi-v-rocknroll 2y ago
      That's neat but I'm embedding the CRC-32 hex digest itself in a TBD location rather than a chosen text. It's moot because the time savings would be premature optimization. Brute force takes only a couple of minutes and I barely use it. Thanks for the thought though.
  - ahazred8ta 2y ago
    Selective partial SHA1/SHA2 matches only take a few seconds. https://github.com/not-an-aardvark/lucky-commit https://github.com/not-an-aardvark/lucky-commit

landgenoot 2y ago

The community here keeps impressing me. Nice job! Yes it could be several years, however the expected value is less than a year. Just like the expected dice rolls before rolling 6 is 6.

hi-v-rocknroll 2y ago
Yes, it's good to disambiguate that it's expected in a statistical sense but it's not an upper bound or confidence interval. I also wrote a program to find CRC32 hash collisions that can be injected into a text file or script to make a text hash to that value. https://gist.github.com/skull-squadron/c85d295cf9e6124dd7e90716dc7b7310 https://gist.github.com/skull-squadron/c85d295cf9e6124dd7e90... Doing so MD5, SHA1, or even SHA256 would be extremely slow and expensive, but not impossible.
- nayuki 2y ago
  You don't need to brute-force CRC-32. I do a preimage attack directly using linear algebra: https://www.nayuki.io/page/forcing-a-files-crc-to-any-value https://www.nayuki.io/page/forcing-a-files-crc-to-any-value
  - hi-v-rocknroll 2y ago
    That's neat but I'm embedding the CRC-32 hex digest itself in a TBD location rather than a chosen text. It's moot because the time savings would be premature optimization. Brute force takes only a couple of minutes and I barely use it. Thanks for the thought though.
- ahazred8ta 2y ago
  Selective partial SHA1/SHA2 matches only take a few seconds. https://github.com/not-an-aardvark/lucky-commit https://github.com/not-an-aardvark/lucky-commit