Report of collision-generation with MD5

[Fernando Gleiser]

On Wed, 18 Aug 2004, Chris Doherty wrote:

>
> well, technically you're not "reversing the hash": you can't re-create a
> message from its hash, because the information is simply gone--digesting
> algorithms are massively lossy by definition. that is, you can't take a
> 128-bit MD5 hash and recover the original 2-megabyte message, which makes
> sense.
>
> what you can do, if you have a proper attack formula, is find *a* message
> that produces *that one hash*. that is, if I have message M which produces
> hash H, I can use the attack to find *a* message M' which will also
> produce hash H.

There are (potentially) infinite inputs and just 2^128 outputs, so you
can always (given enough time and/or horsepower) greate a colision.

The problem is you need to create a message M' such that it is similar
enough to the original one so the recipient gets fooled he got
the original one. I think the odds of backdooring a source code file
and modifying it so it hashes to the same value are very small.



			Fer