3
$\begingroup$

Here is a somewhat silly and atypical problem I am currently facing. Usually, when it comes to hashes, one is bothered with finding collisions and preimages. My problem is, I need to find the IHV used to initialise the word buffers. The message and the hash function output are considered to be known.

Is there a non-bruteforce solution of this problem related to MD5 or SHA-1?

$\endgroup$
3
$\begingroup$

By 'IHV', I assume you mean the Initial Hash Vector; that is, the state of the hash function before you start hashing.

Well, if they aren't using the standard initial values (specified by the hash function definition), well, there isn't much you can do. The problem is that the compression function used by Merkle-Damgaard hash functions (such as MD5 or SHA-1) is specifically designed to be noninvertable; that is, the problem of "finding the previous state, given the final state and the value being hashed" is a hard problem. They design things that way because if that wasn't true, the "second preimage problem" is easier than expected.

This hard problem of "running the hash function backwards" is precisely the problem you would need to solve to reconstruct the hash function's starting value.

$\endgroup$
2
  • $\begingroup$ I see. So, there is no published attack that would allow to solve the problem in less than e.g. 2^160 steps? $\endgroup$ – Dmitry Janushkevich Jul 10 '14 at 16:39
  • 1
    $\begingroup$ @DmitryYanushkevich: no, there is not. In fact, the existence of a method that could solve it in, say, 2^150 steps, could be used to find preimages in 2^156 steps (for SHA-1). $\endgroup$ – poncho Jul 10 '14 at 21:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.