# Are there two known strings which have the same MD5 hash value?

Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?

-
Example in Wikipedia. –  Tomasz Nurkiewicz Dec 11 '11 at 9:04
Welcome to Cryptography Stack Exchange. Your question was migrated here because of being not directly related to software development (the topic of Stack Overflow), and being fully on-topic here. Please register your account here, too, to be able to comment. –  Paŭlo Ebermann Dec 11 '11 at 14:23

## migrated from stackoverflow.comDec 11 '11 at 14:22

This question came from our site for professional and enthusiast programmers.

MD5 was intended to be a cryptographic hash function, and one of the useful properties for such a function is its collision-resistance. Ideally, it should take work comparable to around $2^{64}$ tries (as the output size is $128$ bits, i.e. there are $2^{128}$ different possible values) to find a collision (two different inputs hashing to the same output). (Actually, brute-forcing this is today almost in the range of possible, so this alone would be a reason not to use any small-output hash function like MD5.)

It showed that MD5 is not that resistant as intended, and nowadays it is relatively easy to produce more collisions, even with an arbitrary common prefix and suffix.

There was a spectacular example, when someone used an MD5 collision to get a fake SSL certificate from a certification agency. The agency signed a certificate for a domain which belonged to the attacker, and the attacker produced a different certificate (for another domain) with the same hash, i.e. for which the same signature was valid.

Don't use MD5 for any application which relies on collision-resistance (like signatures) ... or for any new application at all. Use SHA-2 now.

-

A new result shows how to generate single block MD5 collisions, including an example collision:

Message 1

Message 2

> md5sum message1.bin message2.bin
> 008ee33a9d58b51cfeb425b0959121c9 message1.bin
> 008ee33a9d58b51cfeb425b0959121c9 message2.bin


There is an earlier example of a single block collision but not technique for generating it was published.

-
I just saw it too on eprint and was about to post this one, but you beat me to that :) –  Jalaj Jan 30 '12 at 18:26

Yes you can, see at the MD5 Collision Demo:

the two blocks

d131dd02c5e6eec4693d9a0698aff95c 2fcab58712467eab4004583eb8fb7f89 55ad340609f4b30283e488832571415a 085125e8f7cdc99fd91dbdf280373c5b d8823e3156348f5bae6dacd436c919c6 dd53e2b487da03fd02396306d248cda0 e99f33420f577ee8ce54b67080a80d1e c69821bcb6a8839396f9652b6ff72a70

and

d131dd02c5e6eec4693d9a0698aff95c 2fcab50712467eab4004583eb8fb7f89 55ad340609f4b30283e4888325f1415a 085125e8f7cdc99fd91dbd7280373c5b d8823e3156348f5bae6dacd436c919c6 dd53e23487da03fd02396306d248cda0 e99f33420f577ee8ce54b67080280d1e c69821bcb6a8839396f965ab6ff72a70

produce an MD5 collision.

Each of these blocks has MD5 hash 79054025255fb1a26e4bc422aef54eb4.

-

Here are some other interesting examples. One of them is, two downloadable executables that have the same MD5 hash, but are actually different, and produce different (safe) results when run!

So much for using MD5 hashes to ensure download file integrity :-(

http://www.mscs.dal.ca/~selinger/md5collision/

-