# Tag Info

Just to show you how easy it is today to create collisions on MD5: One could create collisions using Marc Steven's HashClash on AWS and estimated the the cost of around $0.65 per collision. These 2 images have the same md5 hash: 253dd04e87492e4fc3471de5e776bc3d (If you want to test it yourself, take images from the link below, after uploading ... 6 Even after your updates, the first part seems unnecessary. However, steps 4-5 do indeed prevent the attacker from learning future nonces they could ask the key MAC values for. So the protocol steps 4-7 would be secure with a secure MAC. I agree with CodesInChaos that using HMAC would be better, because H(m||k) has some weaknesses, while HMAC is standard. ... 2 The approach you describe is very much like the approach that is used in the masterpassword app (http://masterpasswordapp.com/). Roughly they generate a password for each site depending on: Your master password The site name A number (so that if you have to change your password you can just increase the number) Some salts that they decice. And then they ... 4 Is there any problems from using the approach I am suggesting? Yes, there are several. First of all, some sites generate first time passwords, or even long time passwords. You may want to store those too. What if a site requires frequent updates? If one password is reversed, you'd still loose confidentiality. Would it actually be less secure if ... 1 @Jeroba88 your idea of using a hash function rather than just appending the service name to your secret password is simple yet crucial to achieve what you have set off to do. Some level of customisation (be careful), such as using PBKDF2 (or Scrypt) in place of just a plain HASH(Password|Service) (especially since it's probably preferable to use ... 2 There are several different scenarios to consider. If you assume all the sites/apps do things right, use a strong password hash, stay uncompromised, then no one should be able to find your master password anyway (unless it is a very poor low entropy password). So how or whether it is combined at all does not matter. More likely, you are interested in ... 0 Ilmari Karonen's answer is correct when HMAC is used for its intended purpose, but that doesn't mean that HMAC is completely unaffected by MD5's collisions: Given a specific Key, note that K xor opad and K xor ipad are independent of the message m. This means that any collision in H((K xor ipad) || m) will result in a colliding HMAC, even with two ... 2 How can he do that? He could take api_signature = h = md5(m) and use it as the Initialization Vector of the hash function and hash the extra data and another padding. This is the idea behind the hash length_extension attack, isn't it? Correct. My question: The api_signature will change then because it is calculated like: md5(extra || padding) with ... 3 what does 64-bit representation stand for? It's the length (in bits) of the hashed message, expressed as a 64 bit binary value (in little endian order). If you hash a 1 character message,$b=8$(as 1 byte == 8 bits); this would be represented as the 8 bytes 08 00 00 00 00 00 00 00 (the 08 is first, because in little-endian order, you place the ... 2 If your message is longer than$2^{64}$bits, i.e.$b>2^{64}$, which is$2^{61}$bytes, or 16,777,216 Terabytes(!), this is more than 16 million terabytes, you just take the least significant 64 bits of the number$b\$.