cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1995-10-24 - Hash collisions [was Re: MD5 weakness ? …]

Header Data

From: Matt Blaze <mab@crypto.com>
To: hallam@w3.org
Message Hash: 0387f00b6311afa79561f9ebd987a9e1911ce622f911c8c68a9cd552c165a0be
Message ID: <199510241903.TAA18608@crypto.com>
Reply To: <9510241714.AA22217@zorch.w3.org>
UTC Datetime: 1995-10-24 19:02:35 UTC
Raw Date: Tue, 24 Oct 95 12:02:35 PDT

Raw message

From: Matt Blaze <mab@crypto.com>
Date: Tue, 24 Oct 95 12:02:35 PDT
To: hallam@w3.org
Subject: Hash collisions [was Re: MD5 weakness ? ...]
In-Reply-To: <9510241714.AA22217@zorch.w3.org>
Message-ID: <199510241903.TAA18608@crypto.com>
MIME-Version: 1.0
Content-Type: text/plain



>
>>As to weaknesses, I seem to remember that someone managed to forge a
>>modification to a program used to observe networks on a Sun so that it
>>had the same MD5 checksum as the official trusted version.  But whether
>>this is real is not strictly the issue. 
>
>Ron has not mentioned such an event to me and if that were the case I would 
>seriously doubt that he would not have been told about it. The only comment he
  
>generally makes is that he wrote MD5 because "MD4 was making me nervous".
>
>>In the case of the trust being placed in MD5 by Netscape, the assumption
>>being made (without adequate support as far as I can tell) is that an
>>MD5 checksum cannot be forced, through a chosen plaintext attack, to
>
>Netscape do not simply use the MD5 of the message, they are using (as I 
>understand it) the PKCS#1 standard for makoing the signature. If not they 
>probably have severe problems.
>
>>There has been no limit given by anyone on this list to the level of
>>trust they place in MD5.  Several people have posted (without
>>contention) that MD5 is sufficiently trustworthy to trust billions of
>>dollars in commerce to it's being able to prevent a selected plaintext
>>attack as eluded to above. 
>
>NIST and the NSA trusted MD4 sufficiently to base SHA upon it. SHA is preferab
 le 
>in many ways to MD5, it has a different approach to extending the scheduling a
 nd 
>resist differential cryptanalysis. There is a problem with the compressor 
>function of MD5 which I dislike. This is fairly irrelevant though since SSL 
>allows other digests to be used.
>
>	Phill

I hesitate to jump in to this exchange given the defensive and
vague nature of the discussion, but...

While I agree that SHA seems preferable, for a number of reasons,
to MD5, it is worth noting that Hans Dobbertin of the German Information
Security Agency recently found a collision in MD4. His attack
allows you to generate a pair of plainexts that generate the same hash.
A fast technique for finding a second plaintext that hashes to some given
value remains an open problem with MD4 (and SHA and MD5, for that matter).

As far as I can tell the attack does not readily generalize to MD5
or SHA.

-matt

Thread