Full Disclosure mailing list archives
MD5 algorithm considered toxic (and harmful)
From: "Kristian Erik Hermansen" <kristian.hermansen () gmail com>
Date: Sat, 1 Dec 2007 05:06:36 -0800
I know of many commercial security products which still utilize MD5 to prove integrity of the data they distribute to customers. This should no longer be considered appropriate. Now that tools are readily available to exploit newer MD5 collision research, I think it is safe to say that the public should retire its usage for good. Read the most recent research regarding chosen-prefix collisions: http://www.win.tue.nl/hashclash/EC07v2.0.pdf A concrete example for your perusal: khermans@khermans-laptop:/tmp$ wget http://www.win.tue.nl/hashclash/SoftIntCodeSign/HelloWorld-colliding.exe --04:36:32-- http://www.win.tue.nl/hashclash/SoftIntCodeSign/HelloWorld-colliding.exe => `HelloWorld-colliding.exe' Resolving www.win.tue.nl... 131.155.70.190 Connecting to www.win.tue.nl|131.155.70.190|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 41,792 (41K) [application/octet-stream] 100%[====================================>] 41,792 109.16K/s 04:36:33 (108.92 KB/s) - `HelloWorld-colliding.exe' saved [41792/41792] khermans@khermans-laptop:/tmp$ wget http://www.win.tue.nl/hashclash/SoftIntCodeSign/GoodbyeWorld-colliding.exe --04:36:37-- http://www.win.tue.nl/hashclash/SoftIntCodeSign/GoodbyeWorld-colliding.exe => `GoodbyeWorld-colliding.exe' Resolving www.win.tue.nl... 131.155.70.190 Connecting to www.win.tue.nl|131.155.70.190|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 41,792 (41K) [application/octet-stream] 100%[====================================>] 41,792 127.20K/s 04:36:38 (126.82 KB/s) - `GoodbyeWorld-colliding.exe' saved [41792/41792] khermans@khermans-laptop:/tmp$ ls -lsha *.exe 44K -rw-r--r-- 1 khermans khermans 41K 2007-11-23 01:08 GoodbyeWorld-colliding.exe 44K -rw-r--r-- 1 khermans khermans 41K 2007-11-23 01:08 HelloWorld-colliding.exe khermans@khermans-laptop:/tmp$ strings HelloWorld-colliding.exe | tail SetFilePointer MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle CloseHandle KERNEL32.dll Hello World ;-) khermans@khermans-laptop:/tmp$ strings GoodbyeWorld-colliding.exe | tail SetFilePointer MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle CloseHandle KERNEL32.dll Goodbye World :-( khermans@khermans-laptop:/tmp$ md5sum HelloWorld-colliding.exe | awk '{print $1}' | tee hw 18fcc4334f44fed60718e7dacd82dddf khermans@khermans-laptop:/tmp$ md5sum GoodbyeWorld-colliding.exe | awk '{print $1}' | tee gw 18fcc4334f44fed60718e7dacd82dddf khermans@khermans-laptop:/tmp$ cmp hw gw khermans@khermans-laptop:/tmp$ echo $? 0 There you have it. Surely a GPL'd tool implementing this attack style will be available shortly. And since Chinese researchers have been attacking SHA-1 lately, should SHA-256 be considered the proper replacement? I am unsure :-( -- Kristian Erik Hermansen "I have no special talent. I am only passionately curious." _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- MD5 algorithm considered toxic (and harmful) Kristian Erik Hermansen (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) Steven Adair (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) James Matthews (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) Enno Rey (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) Tim (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) Paul Schmehl (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) James Matthews (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) Steven Adair (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) Kristian Erik Hermansen (Dec 01)