Chockstone Forum

      Sponsored By
      ROCK
   HARDWARE

Chockstone Photography

Australian Landscape Prints

Chockstone Forum - Chockstone Feedback

Provide Feedback About This Website

Topic Date User

ummm hacked??? 21-Dec-2006 At 9:37:34 PM PensionerPower

Message

On 21/12/2006 gordoste wrote:

>if i recall correctly you can easily generate MD5 collisions... but not
>in a useful way... so for example if someone was sending a message to a
>website saying "I am gordoste, transfer $100 from my account to account
>12345" the hacker can send something else that appears to be from gordoste
>but he has no control over what that something is...

It's worse than that now. For example, http://cryptography.hyperlink.cz/MD5_collisions.html provides a program "pack3" with the following usage:

pack3 file1 file2 file3 file4 file5 file6

This creates two new programs "package1.exe" and "package2.exe" which have the same MD5 hash. However, package1.exe (when executed) will extract files 1-3, whereas package2.exe (when executed) will extract files 4-6 ! (oops)

This does not necessarily make MD5 unsafe for storing salted password hashes, because I think that it is still not possible to determine a plaintext which, when hashed, will produce a given MD5 value. However, since at least /some/ of MD5's security properties have clearly been broken, we really shouldn't be using it for anything new.

Cheers,
PP