# Is a collision attack possible on MD5 if message is known partially

Is it possible to find $m'$ such that $\operatorname{MD5}(m'||m_1)=\operatorname{MD5}(m_1||m_2)$ if I know $m_2$ and $\operatorname{MD5}(m_1||m_2)$? Is this a collision or a preimage attack?

Also in this case is it possible to find $m'$ and $H$ such that $\operatorname{MD5}(m_1||m')=H$ if I know $\operatorname{MD5}(m_1||m_2)$ and $m_2$?

Basically a message like $(M,\operatorname{MD5}(M||m1))$ is sent from server to client (only client and server know $m_1$). So is there an attack in this scenario?

## migrated from security.stackexchange.comJun 12 '14 at 13:38

This question came from our site for information security professionals.

## 2 Answers

If you have $\operatorname{MD5}(m_1||m_2)$ and you know $m_2$, and want to find $m'$ such that $\operatorname{MD5}(m'||m_2)$ reaches a known, predetermined value, then you must break MD5's preimage resistance, or at least second-preimage resistance.

This would be true even if you knew $m_1$: if you know $m_1$, then the problem becomes: find $m'$ such that $\operatorname{MD5}(m'||x) = y$ for two given values of $x$ and $y$ ($x = m_1$ and $y = \operatorname{MD5}(m'||m_2))$ in your presentation). Since $y$ is the result of MD5 on a known entry, this problem is a second-preimage attack with an extra constraint on the result. MD5 is still quite robust against second-preimage attacks, so this cannot be done with existing knowledge and technology.

Not knowing $m_1$ cannot help: if the problem is already hard with knowledge of $m_1$, then it cannot be easier without knowledge of $m_1$.

The explanation above is the general case. In some cases it can be quite easy: for instance, if $m_2$ happens to be equal to $z||m_1$ for some value $z$, then $m' = m_1||z$ would be a solution.

If you have $\operatorname{MD5}(m_1||m_2)$ and you know $m_2$, then you can trivially compute $\operatorname{MD5}(m_1||m')$ for any $m'$ which begins with $m_2$, followed by the MD padding, followed by arbitrary contents. This requires knowledge of the length of $m_1$ (but not its contents). For details, look up the length extension attack.

md5 is a one-way hashing function remember? Which means:

cipher = md5(plain)


If you know cipher you cannot possibly get plain by reversing md5. Which means:

plain != md5(cipher)


So s it possible to find m3 such that md5(m3+m1)=md5(m1+m2) if I know m2 and md5(m1+m2)

The answer is absolutely not possible. Why you asking? Simple because if you know md5(m1+m2) and m2 it doesn't mean you know m1 or m3 which is the collusion value of m1 in your case.

This not to be confused with symmetric keys encryption, where this scenario is very possible!

If your encryption key for a session-1 is K1 and encryption key for session-2 is K2 and so on.. It is possible to retrieve plain text if you REUSE the key twice as follow:

cipher1 = plain1 XOR K1
cipher2 = plain2 XOR K1


now XOR both ciphers and see what happens:

cipher1 XOR cipher2 = (plain1 XOR K1) XOR (plain2 XOR K1)


Notice how K1 XOR K1 = 0...0000 which makes our cipher = plain1 xOR plain2 which leads to plain text retrieval by guessing one value and trying to figure our the second.