On Wed, 18 Aug 2004, Brett Glass wrote: > At 02:54 PM 8/18/2004, Chris Doherty wrote: > > >what you can do, if you have a proper attack formula, is find *a* message > >that produces *that one hash*. that is, if I have message M which produces > >hash H, I can use the attack to find *a* message M' which will also > >produce hash H. > > The thing is, passwords are short and have limited entropy. Chances are, > if you find a password that produces the same hash, it's M. Details in the paper are few, but I don't think what Chris describes in the snippet Brett quotes is what's necessarily happening. That is, for any given MD5 initial state, they seem to be saying that they can find two related messages that produce the same hash. NOT that they necessarily can find a message with the same has as a _given_ message. Which I guess means that they can tack two different strings on the end of any arbitrary file (since they claim they can attack an arbitrary IV) and the resulting two files will also have the same MD5 hash, but that won't be the MD5 of the original. The two appended strings are effectively random, and differ from each other only in a few bits. -- jan grant, ILRT, University of Bristol. http://www.ilrt.bris.ac.uk/ Tel +44(0)117 9287088 Fax +44 (0)117 9287112 http://ioctl.org/jan/ Hang on, wasn't he holding a wooden parrot? No! It was a porcelain owl. _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"