Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Almost a decade ago Raymond Chen blogged [1] about the "hash reset attack" cautioning developers to record the content length in addition to the message digest.

Recently I came up with a variation on the MD5 hashing algorithm that incorporates the file size. I've called this algorithm 'MDS' for 'Message Digest + Size' but hilariously "MDS" is a "cancer"... :P

You can see the javascript or PHP implementation of MDS [2].

So, is this a good idea? Do you think it would raise the bar for collision generation? I'm way out of my depth... sort of seems like a good idea, but I'm not armed with facts.

Perhaps, as I have been cautioned, I shouldn't be using MD5 at all..?

[1] http://blogs.msdn.com/b/oldnewthing/archive/2004/05/19/134937.aspx [2] https://svn.jj5.net/jjrepo/mds/trunk/src/

share|improve this question

1 Answer 1

up vote 3 down vote accepted

That is an absolutely terrible idea, here is why.

His algorithm works as follows:
Hash the input data
Take the length of data (presumably in bytes)
TRUNCATE the hash so that the length value in bytes plus the truncated hash is the output length of a standard MD5 hash (128 bits)

Here is an example of a 1MB data file being hashed

MD5(data) = e319709e00ec584c412603b83f661b2b
len(data) = 40000000
MDS(data) = e319709e00ec584c412603b840000000

Most MD5 collision attacks are on signatures with a fixed length, this will only make it easier to create a collision, since you do not have to worry about the truncated buts at the end as part of your collision calculation.

The length of the input data for some applications is also a secret or can expose information about the data, so it is part of the input padding to the hash and not the output.

share|improve this answer
    
I addressed the content length disclosure design flaw: code -- is that better? –  John Elliot V Apr 4 at 17:39
    
No that is even worse. No you have a bitwise operation on 2 potentially different length variables, AND you are potentially exposing plaintext data through the use of CRC. AND you are still reducing the length of the actual hash. –  Richie Frame Apr 4 at 19:56
    
Essentially you are trying to solve a problem that already has a solution. The solution is to not use MD5. Other MD style hashes are susceptible to length extension attacks, I have my own thoughts on a "solution" to that problem: groups.google.com/forum/#!topic/sci.crypt/niNqdJHYTP4 –  Richie Frame Apr 4 at 20:08
    
Cool, thanks for your help Richie. I think I'll use SHA1 instead of MD5, is that OK? :P –  John Elliot V Apr 5 at 7:25
    
SHA1 is only "acceptable" if you need a hash with 64-bit security or less, and has been superceded with SHA224 and up since 2010. The security SHA1 is supposed to have is 80 bits, but now only exhibits the security of a 128-bit hash. –  Richie Frame Apr 5 at 9:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.