# Are there any practical attacks that create a printable chosen prefix MD5 collision?

I would like to create two ASCII text messages with the same MD5. Is this possible? If not, is there a similar but less strict attack that could work?

Or to rephrase my last question: what are the minimum prerequisites for the message alphabet?

Also: Do the Flame and Hashclash attacks have different prerequisites?

• What are expecting the two messages to look like? A readable message followed by random printable ASCII? If you read the papers, you can find the sufficient conditions that are required. I think its unlikely for the extension to be anything readable, or printable ASCII. In the Flame and Hashclash attacks, the extension was in the public key area of the certificate, so it was acceptable that it wasn't readable. – user13741 Jul 3 '15 at 18:29
• I'm not sure if it fits your needs, but you could use any byte code after a 00 character. Many editors and such don't display anything after the 00 "end of file/input" control character. – Maarten Bodewes Jul 3 '15 at 21:33
• @MaartenBodewes Hey, I really like that idea! And I’m not saying that just because it fits the “less strict attack” definition. There are a hand full of other control chars that – if placed carefully – will not render visually either. (Gotta keep that in mind for something else I’m fiddling with (jobwise). It would be hilarious if I would manage to produce one or more ASCII messages saying "broken" in that home-brew thingy they dared to throw on my desk last friday. If all works out, monday will be a good day for infosec presentations. Tnx for being so inspiring, even if you didn’t plan to. ;) – e-sushi Apr 23 '16 at 17:55
• @MaartenBodewes a zero-byte is end of string (in memory) in C -- and as a result in lots of things (including other languages) that use libraries or primitives written in C. A while back there was a spate of SSL (HTTPS) certificate frauds where the name might be displayed like trustedbank.com but was actually trustedbank.com\0subdomainof.stealyourmoney.com. – dave_thompson_085 Apr 24 '16 at 8:26

## 1 Answer

In general, most of the readable MD5 attacks are carried out in formats that make it possible to add non-printing elements, such as postscript. It is hard, yet possible, to create collisions going down to pure ascii or hex. However, they may or most likely will not be readable, and if the hex is doing something meaningful, e.g. assembler code, the code will most likely be faulty.

In general, it is possible when certain bits are changed in certain positions- they have to be identified, by trial and error or looking for flaws, both in the algorithm or the implementation.

Here is a Stack Overflow question on creating collisions: Create your own MD5 collisions