Single-block collision for MD5

Re:Single-block collision for MD5 by dchest on Sunday January 29, 2012 @12:00PM (#3525523)

Nice! From PDF:

                   Message 1  
    
    4d c9 68 ff 0e e3 5c 20 95 72 d4 77 7b 72 15 87
    d3 6f a7 b2 1b dc 56 b7 4a 3d c0 78 3e 7b 95 18
    af bf a2[00]a8 28 4b f3 6e 8e 4b 55 b3 5f 42 75
    93 d8 49 67 6d a0 d1[55]5d 83 60 fb 5f 07 fe a2
                      
                   Message 2
     
    4d c9 68 ff 0e e3 5c 20 95 72 d4 77 7b 72 15 87
    d3 6f a7 b2 1b dc 56 b7 4a 3d c0 78 3e 7b 95 18
    af bf a2[02]a8 28 4b f3 6e 8e 4b 55 b3 5f 42 75
    93 d8 49 67 6d a0 d1[d5]5d 83 60 fb 5f 07 fe a2
                       
                 Common MD5 hash
    
           008ee33a9d58b51cfeb425b0959121c9

[ Parent | on HN ]

Re:Single-block collision for MD5 by 0x0 on Sunday January 29, 2012 @03:47PM (#3526204)

Wow, so only two bits flipped? That's pretty bad even if you're using md5 just as a simple checksum protection against transmission errors.

[ Parent | on HN ]

Re:Single-block collision for MD5 by tankenmate on Sunday January 29, 2012 @04:43PM (#3526371)

If you are trying to protect against transmission errors then md5 is a poor choice; it is expensive, it gives no guarantees as to how accurate it is, and has no ability to correct errors. If you want to protect against transmission errors, and possibly correct them, use CRCs; apart from the fact that they provide all three of the above, that's what they were designed for.

[ Parent | on HN ]

Re:Single-block collision for MD5 by tptacek on Sunday January 29, 2012 @05:17PM (#3526454)

Very well optimized CRC is significantly faster than MD5, but note that MD5 is very fast.

MD5 is also a poorer choice for UUID-type applications than the SHA-2 functions, which offer more flexibility in output size at not much cost in performance.

[ Parent | on HN ]

Re:Single-block collision for MD5 by rphlx on Sunday January 29, 2012 @04:17PM (#3526292)

Not really. This collision required specific intent, and a great deal of compute power, to find.

md5 is still adequate for accidental/random error detection because the universe doesn't (usually) spend many hundreds of hours on hundreds of GPUs to try to corrupt your data without you noticing :)

[ Parent | on HN ]

Re:Single-block collision for MD5 by snewman on Sunday January 29, 2012 @06:10PM (#3526622)

Though sometimes it can seem that way. :)

[ Parent | on HN ]

Re:Single-block collision for MD5 by 0x0 on Sunday January 29, 2012 @06:27PM (#3526668)

Fair point. I just kind of assumed that any collision would require quite a lot of flipped bits, because usually just one flipped bit is enough to cause an "avalanche" of changes in the hash sum.

Would it be possible to find a collision where only one bit is flipped in the input?

[ Parent | on HN ]