Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Here is a somewhat silly and atypical problem I am currently facing. Usually, when it comes to hashes, one is bothered with finding collisions and preimages. My problem is, I need to find the IHV used to initialise the word buffers. The message and the hash function output are considered to be known.

Is there a non-bruteforce solution of this problem related to MD5 or SHA-1?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

By 'IHV', I assume you mean the Initial Hash Vector; that is, the state of the hash function before you start hashing.

Well, if they aren't using the standard initial values (specified by the hash function definition), well, there isn't much you can do. The problem is that the compression function used by Merkle-Damgaard hash functions (such as MD5 or SHA-1) is specifically designed to be noninvertable; that is, the problem of "finding the previous state, given the final state and the value being hashed" is a hard problem. They design things that way because if that wasn't true, the "second preimage problem" is easier than expected.

This hard problem of "running the hash function backwards" is precisely the problem you would need to solve to reconstruct the hash function's starting value.

share|improve this answer
    
I see. So, there is no published attack that would allow to solve the problem in less than e.g. 2^160 steps? –  Dmitry Yanushkevich Jul 10 at 16:39
1  
@DmitryYanushkevich: no, there is not. In fact, the existence of a method that could solve it in, say, 2^150 steps, could be used to find preimages in 2^156 steps (for SHA-1). –  poncho Jul 10 at 21:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.