Tag Info

New answers tagged

2

There is absolutely no reason to use HMAC-MD5 in a new product. Don't. HMAC-MD5 security can still work in many roles, but should not be regarded as "secure" unless you can do extensive analysis as to EXACTLY how it's used. In particular, it is "secure" for document signing only if you are sure that the signer is NOT motivated to break security. What ...


1

I'm not aware of any case where somebody actually searched for such a collision. However it would certainly be possible as the same workload ($2^{64}$) was already accomplished a few years ago (2002) by this project, having brute-forced RC5-64. Now assume you'd use the full power of the bitcoin blockchain (300 Peta-Hashes / s = 600 Peta-Hashes /s for ...


1

To build on tylo's answer, here's a practical internal collision attack on this construction, assuming that the block cipher $\rm Enc$ has a 128-bit block size (like AES, for example) or less: Pick an arbitrary initial block $m_0$, and calculate $c_0 = {\rm Enc}_{m_0}(m_0)$. If $c_0$ has less than $n/2 = 64$ bits set, pick a new $m_0$ and repeat. (On ...


4

The padding scheme isn't collision resistant. For any message $m$ where $|m| \not\equiv 0 \pmod n$, there will always be a collision between $m$ and $m || 0$.


2

If you got $n$ blocks, then you compute the encryption of each block, and let's look at one bit at position $j$. Let's call this $c_{i,j}= E(m_i)[j]$. Now what you will get at position $i$ in your output is $(((c_{i,1} \bar{\vee} c_{i,2}) \bar{\vee}c_{i,3}) \bar{\vee} \dots )\bar{\vee}c_{i,n}$. If we assume that all $c_{i,j}$ are evenly distributed in ...


0

looks like it it is collision resistant, as hashes the message "twice" Is collision resistant, as a part of the digest is collision resistant. Is always $0$, so not collision resistant Collision resistant, as it hashes the message twice and outputs a valid hash of a valid message (the hash of the message) Always the same. Not collision resistant Always the ...


6

Summary: a single HMAC-MD5 with a key later revealed is a completely insecure way to do commitments of messages that can be chosen malignantly, because of the ease with which MD5 collisions can now be found. There is no compelling evidence that's so insecure for messages constrained to belong in a small arbitrary set that no adversary can choose or ...


0

If you want an absolute guarantee of no collisions, then use a cipher, not a hash. Encrypt the numbers 0, 1, 2, ... 99998, 99999, 100000 and the outputs are guaranteed to be unique for a given key. Convert to hex or Base64 for incorporation into a filename. Hasty Pudding cipher can be set for any desired range of numbers, or use DES for 64 bit numbers. ...



Top 50 recent answers are included