News for hackers. Stuff that matters.

A comment on PHP: md5('240610708') == md5('QNKCDZO'). Parent comment

Re:PHP: md5('240610708') == md5('QNKCDZO') by masklinn on Monday May 04, 2015 @06:20AM (#9485269)
> The likelihood of generating a hash value with that kind of prefix is 2 in 65536.

The prefix is not sufficient though, the suffix must be entirely decimal otherwise it's not a valid number in scientific notation.

[ Parent | on HN ]
Re:PHP: md5('240610708') == md5('QNKCDZO') by dietrichepp on Monday May 04, 2015 @06:35AM (#9485318)
The prefix is sufficient. Any hash matching /0e[0-9].*/ works.
[ Parent | on HN ]
Re:PHP: md5('240610708') == md5('QNKCDZO') by masklinn on Monday May 04, 2015 @06:43AM (#9485340)
As far as I can see the prefix is not sufficient, a single non-digit character in the tail fails the conversion (and the equality check): http://3v4l.org/ctASF (vs http://3v4l.org/5FvJu, exact same strings but for the last character replaced by a digit)
[ Parent | on HN ]
Re:PHP: md5('240610708') == md5('QNKCDZO') by userbinator on Monday May 04, 2015 @07:05AM (#9485401)
Which means the probability of generating a hash value of the form 0[eE][0-9]{30} is (1/128)(10/16)^30 or 5.9e-9.

It certainly reduces the strength of the hash (and MD5 shouldn't be used anymore in any case), but still a roughly 6 in a billion chance of someone choosing e.g. a password and it happening to be exploitable in this manner.

[ Parent | on HN ]