1
$\begingroup$

Almost a decade ago Raymond Chen blogged about the "hash reset attack" cautioning developers to record the content length in addition to the message digest.

Recently I came up with a variation on the MD5 hashing algorithm that incorporates the file size. I've called this algorithm 'MDS' for 'Message Digest + Size' but hilariously "MDS" is a "cancer"... :P

You can see the JavaScript or PHP implementation of MDS here.

So, is this a good idea? Do you think it would raise the bar for collision generation? I'm way out of my depth... sort of seems like a good idea, but I'm not armed with facts.

Perhaps, as I have been cautioned, I shouldn't be using MD5 at all..?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
4
$\begingroup$

That is an absolutely terrible idea, here is why.

His algorithm works as follows:

  1. Hash the input data
  2. Take the length of data (presumably in bytes)
  3. TRUNCATE the hash so that the length value in bytes plus the truncated hash is the output length of a standard MD5 hash (128 bits)

Here is an example of a 1MB data file being hashed

MD5(data) = e319709e00ec584c412603b83f661b2b
len(data) = 40000000
MDS(data) = e319709e00ec584c412603b840000000

Most MD5 collision attacks are on signatures with a fixed length, this will only make it easier to create a collision, since you do not have to worry about the truncated bits at the end as part of your collision calculation.

The length of the input data for some applications is also a secret or can expose information about the data, so it is part of the input padding to the hash and not the output.

Improve this answer
$\endgroup$
6
  • $\begingroup$ I addressed the content length disclosure design flaw: code -- is that better? $\endgroup$
    – John Elliot V
    Apr 4, 2014 at 17:39
  • $\begingroup$ No that is even worse. No you have a bitwise operation on 2 potentially different length variables, AND you are potentially exposing plaintext data through the use of CRC. AND you are still reducing the length of the actual hash. $\endgroup$
    – Richie Frame
    Apr 4, 2014 at 19:56
  • $\begingroup$ Essentially you are trying to solve a problem that already has a solution. The solution is to not use MD5. Other MD style hashes are susceptible to length extension attacks, I have my own thoughts on a "solution" to that problem: groups.google.com/forum/#!topic/sci.crypt/niNqdJHYTP4 $\endgroup$
    – Richie Frame
    Apr 4, 2014 at 20:08
  • $\begingroup$ Cool, thanks for your help Richie. I think I'll use SHA1 instead of MD5, is that OK? :P $\endgroup$
    – John Elliot V
    Apr 5, 2014 at 7:25
  • $\begingroup$ SHA1 is only "acceptable" if you need a hash with 64-bit security or less, and has been superceded with SHA224 and up since 2010. The security SHA1 is supposed to have is 80 bits, but now only exhibits the security of a 128-bit hash. $\endgroup$
    – Richie Frame
    Apr 5, 2014 at 9:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.