3 ms·

I perhaps used the wrong term. I meant straight-up collision with a modified length. The known MD5 collision attack needs to modify the length of the message;

by hrjet 12y ago

I perhaps used the wrong term. I meant straight-up collision with a modified length. The known MD5 collision attack needs to modify the length of the message; finding a collision with the same length is extremely difficult. It would be reasonable to assume that attacks on other hashing algorithms would suffer the same constraint. Wouldn't having the length specified in the integrity attribute help reduce chances of a future attack? The cost of specifying the length is negligible; about 12 bytes for a base-64 encoded 64-bit unsigned int.

sjy 12y ago
You're essentially using the length as a(n extremely weak) secondary hash in that case. That might be sufficient to disable one known MD5 exploit, but if you're worried about vulnerabilities in your primary hash algorithm it would make more sense to use another real hash algorithm for your backup.
- hrjet 12y ago
  Thanks for the answer. I am really not familiar with the mathematics of hash algorithms and I ask just to learn. Why is length essentially a weak hash? Isn't it an additional constraint that works orthogonal to the hash? It serves to restrict the space of collisions and hence directly reduces the exploit surface. Moreover, the length can be independently verified of the hash function, and its space & time complexity is negligible.
  - Dylan16807 12y ago
    > Why is length essentially a weak hash? It's utterly trivial to match by itself. Adding length to a real hash is a mild difficulty increase. Adding a second hash is a massive difficulty increase. > Isn't it an additional constraint that works orthogonal to the hash? Yes. But so is a second hash. > It serves to restrict the space of collisions and hence directly reduces the exploit surface. Very inefficiently. > Moreover, the length can be independently verified of the hash function, and its space & time complexity is negligible. A second hash is independent of the first hash too. Hashing a second time compared to downloading and hashing the first time is pretty close to negligible.

by hrjet 12y ago

sjy 12y ago

You're essentially using the length as a(n extremely weak) secondary hash in that case. That might be sufficient to disable one known MD5 exploit, but if you're worried about vulnerabilities in your primary hash algorithm it would make more sense to use another real hash algorithm for your backup.

hrjet 12y ago
Thanks for the answer. I am really not familiar with the mathematics of hash algorithms and I ask just to learn. Why is length essentially a weak hash? Isn't it an additional constraint that works orthogonal to the hash? It serves to restrict the space of collisions and hence directly reduces the exploit surface. Moreover, the length can be independently verified of the hash function, and its space & time complexity is negligible.
- Dylan16807 12y ago
  > Why is length essentially a weak hash? It's utterly trivial to match by itself. Adding length to a real hash is a mild difficulty increase. Adding a second hash is a massive difficulty increase. > Isn't it an additional constraint that works orthogonal to the hash? Yes. But so is a second hash. > It serves to restrict the space of collisions and hence directly reduces the exploit surface. Very inefficiently. > Moreover, the length can be independently verified of the hash function, and its space & time complexity is negligible. A second hash is independent of the first hash too. Hashing a second time compared to downloading and hashing the first time is pretty close to negligible.