Tag Info

The general justification is several years of cryptographic research in trying to "break" hash functions. As far as I know there is no "proof" that finding pre-images of a hash are hard. It is just assumed to be hard based on the history of effort trying to invert it. A hash function considered secure today may well turn out to be weak tomorrow. This ...

Preimage resistance is about the most basic property of a hash function which can be thought. It means: For a given $h$ in the output space of the hash function, it is hard to find any message $x$ with $H(x) = h$. (Note that the it is hard here and in the next definitions is not formally defined, but can be formalized by looking at families of hash ...

It sounds like you're pretty much out of luck. Yes, there are a few tricks you could use to speed up a brute force search; for example, if we fix everything other than DWORD 3 of B, we can precompute everything up to round 10 of MD5, and compute what the value of the internal 'b' variable of round 52 of MD5 must be to generate the expected hash; this ...

If the hash function is any good, then it should behave as a "random function" (i.e. a function chosen randomly and uniformly among all possible functions). For a random function with output size $n$ bits, it is expected that nested application will follow a "rho" pattern: the sequence of successive values ultimately enters a cycle with an expected size of ...

Cryptographic hash functions (like everything else a traditional computer does) can be described as a set of binary operations, XOR, register rotate, and binary addition being very common. These translate directly to a classic computer science problem known as "binary satisfiability" or SAT. SAT problem has been proven NP-complete. To butcher the definition ...

You are not asking for a collision but for a preimage. Collision attack: the attacker computes two messages m and m', distinct from each other, such that m and m' hash to the same value. Preimage: the attacker is given a goal (a hash value h) and finds a message m which hashes to h. MD5 is weak for collisions, but not for preimages: no attack method is ...

Actually, to the best of our knowledge, it's computationally infeasible. By the terminology what we use when we discuss cryptographical hash functions, you're not asking for a hash collision (which is "find two different messages that hash to the same value"), but instead you're asking for a hash preimage (which is "for this hash value, find a message that ...

Often the hash (iterated and salted mostly) of a password is saved in a database, instead of the password. If a user logs in, the hash is computed and compared against the stored hash value. This way a user that can see the database of hashes does not see the password directly, but this property depends crucially on the hash being resistant to a pre-image ...

A collision attack is the ability to find two inputs that produce the same result, but that result is not known ahead of time. In a typical case (e.g., the attack on MD5) only a relatively small number of specific inputs are known to produce collisions. Collision resistance obviously means that a collision attack is difficult (for some definition of ...

Consider the function $H$ transforming a message $m$ to the SHA-512 hash of the first 1024 bits of $m$ (right-padded with $1024-n$ zero bits if the bit length $n$ of $m$ is less than 1024). $H$ is first-preimage resistant, but not second-preimage resistant: once you have a first preimage $m_1$, it is trivial to get another $m_2$ with the same hash (e.g. ...

We know no practically feasible way to do what you ask for, except if the hash X=acf3602b5eb9a2db3e365d3043682faf or the content of the file wczasp.rb was prepared specially to make that possible. Assuming that the content of file wczasp.rb is arbitrary, what is asked would be a preimage attack. This is further sub-classified as first preimage if only the ...

As Mike asked, it's not clear if you're asking about onewayness, or collision resistance (as you call the function a 'cryptographic compression function'). Assuming you're asking about onewayness, well, given a single 128 bit value $h(M)$, we obviously cannot uniquely deduce the 1408 bit value $M$. However (hint), let us assume that we can ask for the ...

Your idea is equivalent to doing "constant folding" or "partial compilation". It's not likely to make much difference (see below for detailed explanation). But, even setting that aside, there's a more significant reason why you're not gonna be able to find B. In your situation, the unknown part (B) is 4 DWORDs long, i.e., 128 bits long. This means that ...

Short answer: no you can't, MD5 is not that broken. Long answer: if you really need to do that, a laptop i5 is able to try 5 millions of MD5 hashes per second; on average you will have to try 2^32 ~ 4300 millions hashes, so that it will be a matter of minutes on any decent remotely-modern CPU.

I have ask as part of my answer, "What problem are you trying to solve?" Do you want a secure unkeyed hash function? If you do, then there are plenty of them around. Even some of the ones that are broken for some uses might be okay for yours (SHA-1 springs to mind -- note the discussion above on HMAC and how broken a hash function has to be). But really, ...