MD5 - Revision history

Fmendel: /* Collision Attacks */

2008-11-10T13:20:50Z

‎Collision Attacks

Fmendel: /* Best Known Results */

2008-11-10T11:58:29Z

‎Best Known Results

Fmendel: /* Preimage Attacks */

2008-11-10T11:58:11Z

‎Preimage Attacks

Crechberger: /* Best Known Results */

2008-03-12T08:27:56Z

‎Best Known Results

Fmendel: /* Specification */

2008-03-12T07:45:49Z

‎Specification

Fmendel: /* Specification */

2008-03-12T07:45:05Z

‎Specification

Tnad: /* Collision Attacks */

2008-03-11T10:12:40Z

‎Collision Attacks

Mlamberger: /* Collision Attacks */

2008-03-11T10:12:32Z

‎Collision Attacks

Mschlaeffer at 10:07, 11 March 2008

2008-03-11T10:07:17Z

Mlamberger: /* Collision Attacks */

2008-03-11T10:06:53Z

‎Collision Attacks

@@ Line 102: / Line 102: @@
    abstract = {We introduce the idea of differential cryptanalysis mod 2^32 and apply it to the MD5 message digest algorithm. We derive a theory for differential cryptanalysis of the circular shift function. We demonstrate a high-probability differentials which leave the message digest register unchanged for each of MD5’s four rounds, and explain how more such differentials may be calculated.},
    url = {http://link.springer.de/link/service/series/0558/bibs/0658/06580071.htm},
+}
 </bibtex>

@@ Line 11: / Line 11: @@
 === Best Known Results ===
-The best known collision attack is due to Klima with a complexity of 2<sup>29</sup> effort. No preimage or 2nd preimgae attacks are known.
+The best known collision attack is due to Klima with a complexity of 2<sup>29</sup> effort.
 ----

← Older revision		Revision as of 11:58, 10 November 2008
Line 113:		Line 113:
	=== Preimage Attacks ===		=== Preimage Attacks ===

		+	<bibtex>
		+	@inproceedings{acispSasakiA08,
		+	author = {Yu Sasaki and Kazumaro Aoki},
		+	title = {Preimage Attacks on Step-Reduced MD5},
		+	booktitle = {ACISP},
		+	year = {2008},
		+	pages = {282-296},
		+	abstract = {In this paper, we propose preimage attacks on step-reduced MD5. We show that a preimage of a 44-step MD5 can be computed to a complexity of 2^96. We also consider a preimage attack against variants of MD5 where the round order is modified from the real MD5. In such a case, a preimage of a 51-step round-reordered MD5 can be computed to a complexity of 2^96. Our attack uses local collisions of MD5 to create a degree of message freedom. This freedom enables us to match the two 128-bit intermediate values efficiently.},
		+	url = {http://dx.doi.org/10.1007/978-3-540-70500-0_21},
		+	editor = {Yi Mu and Willy Susilo and Jennifer Seberry},
		+	publisher = {Springer},
		+	series = {LNCS},
		+	volume = {5107},
		+	isbn = {978-3-540-69971-2},
		+	}
		+	</bibtex>

	----		----

← Older revision		Revision as of 08:27, 12 March 2008
Line 10:		Line 10:

	=== Best Known Results ===		=== Best Known Results ===
		+
		+	The best known collision attack is due to Klima with a complexity of 2<sup>29</sup> effort. No preimage or 2nd preimgae attacks are known.

	----		----

@@ Line 4: / Line 4: @@
 * max. message length: < 2<sup>64</sup> bits
 * compression function: 512-bit message block, 128-bit chaining variable
-* Specification: [http://www.ietf.org/rfc/rfc1321.txt RFC 1321]
+* Specification: [http://www.ietf.org/rfc/rfc1321.txt RFC1321]
 == Cryptanalysis ==

@@ Line 21: / Line 21: @@
 === Collision Attacks ===
+<bibtex>
 <bibtex>
 @inproceedings{eurocryptStevensLW07,

← Older revision		Revision as of 10:12, 11 March 2008
Line 21:		Line 21:

	=== Collision Attacks ===		=== Collision Attacks ===
		+
		+	<bibtex>
		+	@inproceedings{eurocryptStevensLW07,
		+	author = {Marc Stevens and Arjen K. Lenstra and Benne de Weger},
		+	title = {Chosen-Prefix Collisions for MD5 and Colliding X.509 Certificates for Different Identities},
		+	booktitle = {EUROCRYPT},
		+	year = {2007},
		+	pages = {1-22},
		+	abstract = {We present a novel, automated way to find differential paths for MD5. As an application we have shown how, at an approximate expected cost of 250 calls to the MD5 compression function, for any two chosen message prefixes P and P′, suffixes S and S′ can be constructed such that the concatenated values P\|\|S and P′\|\|S′ collide under MD5. Although the practical attack potential of this construction of chosen-prefix collisions is limited, it is of greater concern than random collisions for MD5. To illustrate the practicality of our method, we constructed two MD5 based X.509 certificates with identical signatures but different public keys and different Distinguished Name fields, whereas our previous construction of colliding X.509 certificates required identical name fields. We speculate on other possibilities for abusing chosen-prefix collisions. More details than can be included here can be found on www.win.tue.nl/hashclash/ChosenPrefixCollisions/.},
		+	editor = {Moni Naor},
		+	volume = {4515},
		+	series = {LNCS},
		+	publisher = {Springer},
		+	isbn = {978-3-540-72539-8},
		+	url = {http://dx.doi.org/10.1007/978-3-540-72540-4_1},
		+	}
		+	</bibtex>

	<bibtex>		<bibtex>

@@ Line 36: / Line 36: @@
    isbn = {3-540-25910-4},
    url = {http://dx.doi.org/10.1007/11426639_2},
+}
 </bibtex>

← Older revision		Revision as of 10:06, 11 March 2008
Line 21:		Line 21:

	=== Collision Attacks ===		=== Collision Attacks ===
		+
		+	<bibtex>
		+	@inproceedings{eurocryptWangY05,
		+	author = {Xiaoyun Wang and Hongbo Yu},
		+	title = {How to Break MD5 and Other Hash Functions},
		+	booktitle = {EUROCRYPT},
		+	year = {2005},
		+	pages = {19-35},
		+	abstract = {MD5 is one of the most widely used cryptographic hash functions nowadays. It was designed in 1992 as an improvement of MD4, and its security was widely studied since then by several authors. The best known result so far was a semi free-start collision, in which the initial value of the hash function is replaced by a non-standard value, which is the result of the attack. In this paper we present a new powerful attack on MD5 which allows us to find collisions efficiently. We used this attack to find collisions of MD5 in about 15 minutes up to an hour computation time. The attack is a differential attack, which unlike most differential attacks, does not use the exclusive-or as a measure of difference, but instead uses modular integer subtraction as the measure. We call this kind of differential a modular differential. An application of this attack to MD4 can find a collision in less than a fraction of a second. This attack is also applicable to other hash functions, such as RIPEMD and HAVAL.},
		+	editor = {Ronald Cramer},
		+	volume = {3494},
		+	series = {LNCS},
		+	publisher = {Springer},
		+	isbn = {3-540-25910-4},
		+	url = {http://dx.doi.org/10.1007/11426639_2},
		+	}
		+	</bibtex>

	<bibtex>		<bibtex>