# Is md5(x)&md5(y&x) secure?

I was wondering if the following hash function

f(x) := md5(x) & md5('abc'&x)


(with & as concatenation operator) is secure.

This schema can be even extended like this:

g(x) := md5(x) & md5('abc'&x) & md5('def'&x)


To find a collission in f(x), following requirements would be met:

f(x)=f(x'), x!=x' <==> md5(x)=md5(x') ^ md5('abc'&x)=md5('abc'&x')


or

g(x)=g(x'), x!=x' <==> md5(x)=md5(x') ^ md5('abc'&x)=md5('abc'&x') ^ md5('def'&x)=md5('def'&x')


Is this realistic that such a condition can be found? I can't imagine that.

• I agree with @NeilSmithline. My response, and probably the response of others is going to be "just avoid using MD5 and any constructions using MD5." But crypto.SE can better respond to the math part. – HexTitan Oct 24 '15 at 17:06
• For collision resistance, this question reduces to Are there MD5 collisions for inputs of different length? – CodesInChaos Oct 24 '15 at 21:57
• @CodesInChaos, how so? Does not seem like different-length collisions would be required (or immediately helpful) for breaking this. – otus Oct 25 '15 at 10:59

f(x) := md5(x) ++ md5('abc' ++ x) will be just as vulnerable to preimage attacks as md5 -- that is given some hash f(x) = 5d41402abc4b2a76b9719d911017c592d76051e1dae76d1f309598102df58d84 find x. You simply truncate look at the first 128-bits of the 256-bit hash and it reduces to the problem of md5(x)=5d41402abc4b2a76b9719d911017c592, which you can type into several online md5 reverse lookups (the second half reversed too without me adding it). So you can see this method will not be secure for user chosen passwords (at least for typical users).
Now md5 is not collision resistant. It is possible to construct pairs of text such that m1 != m2, while md5(m1) == md5(m2). Granted if you found a collision in md5, this collision would not work immediately for f(x) as in general md5('abc' ++ m1) != md5('abc' ++ m2) when md5(m1) == md5(m2). However, the underlying flaws of md5 is that is built on the Merkle-Damgård construction will still be present and probably could still be exploited (things like how md5(m1++x) == md5(m2++x) will always be true if md5(m1) == md5(m2)) and could probably still be exploited (even if its not immediately obvious and would be more complicated than simply combining existing attacks).