Greetings and Salutations: On 12/6/04 5:29 PM, "Dan Kaminsky" <dan@xxxxxxxxxxx> wrote: <snip> > Some highlights from the paper: > * The attack itself is pretty limited -- essentially, we can create > "doppelganger" blocks (my term) anywhere inside a file that may be > swapped out, one for another, without altering the final MD5 hash. This > lets us create any number of binary-inequal files with the same md5sum. >From my reading it appears that you need the original source to create the doppelganger blocks. It also appears that given a MD5 hash you could not create a input that would give that MD5 back. Passwords encoded with MD5 would not fall prey to your discovery. Is this correct? Unfortunately when "The Press" publicized the MD5 hash discovery by Joux and Wang it almost sounded like "The Press" was surprised to find collisions in the MD5 domain (intuitive to me, a limited number of outputs and a infinite number of inputs = Collisions). I assume that a "good" hash would have a even distribution of collisions across the domain and that the larger number of bits for the output the better the hash (assuming no cryptographic algorithm errors). Thanks, Ken --------------------------------------------------------------- Do not meddle in the affairs of wizards for they are subtle and quick to anger. Ken Hollis - Gandalf The White - gandalf@xxxxxxxxxxx - O- TINLC WWW Page - http://digital.net/~gandalf/ Trace E-Mail forgery - http://digital.net/~gandalf/spamfaq.html Trolls crossposts - http://digital.net/~gandalf/trollfaq.html
