1
$\begingroup$

If it is possible, could an attacker create a collision for an MD5 password in a database? Could they look at an MD5 hash output and figure out data that creates the same MD5 hash?

$\endgroup$
5
  • 2
    $\begingroup$ What do you mean by clash. Do you mean collision? $\endgroup$
    – Ievgeni
    Jun 30 at 12:08
  • $\begingroup$ Yes. I have heard clashing and collision but I wasn't sure which one to use. $\endgroup$
    – Practixal
    Jun 30 at 14:36
  • $\begingroup$ I suggest you to read definitions of one-wayness, second-preimage resistance, and collision resistance, and then to clarify your question. Because it's not clear for me what do you want to do. $\endgroup$
    – Ievgeni
    Jun 30 at 14:40
  • $\begingroup$ I think that the key-word is "second-preimage resistance" and nor collision neither preimage-resistance. $\endgroup$
    – Ievgeni
    Jun 30 at 18:06
  • $\begingroup$ A way to "look at an MD5 hash output and figure out data that creates the same MD5 hash" would be a first-preimage attack. A first-preimage attack can easily be converted into a collision attack (or a second-preimage attack), but the reverse is not true: a collision attack cannot (generally) be converted into either type of preimage attack. $\endgroup$ Jun 30 at 18:37
2
$\begingroup$

Generally no. To create a collision you should have control over the input of both calculations. To be precise, messages should be identical but for 128 bytes at a 64 byte boundary. The fact that most passwords are pretty short and do not consist of binary data is obviously not going to be of any help.

Even if the password is salted it won't give an adversary much grip; usually the salt is controlled by the service, and if it wasn't then it would still be tricky if not impossible to create a collision.

Finding an message for an existing hash requires a break in the pre-image resistance property. MD5 still has a high - but not perfect - pre-image resistance. The best attack on pre-image resistance takes more than $2^{123}$ operations. So that is entirely out of the question (and you'd find the original password, not another password in all likelihood).

Guessing the password is also possible of course, but that won't create a separate password with the same hash. There are multiple ways of speeding up the guesswork, e.g. using rainbow tables, but that's a separate topic.

$\endgroup$
3
  • 3
    $\begingroup$ Finding a message for an existing hash requires a break in the (first) pre-image resistance property, or guessing the message. $\endgroup$
    – fgrieu
    Jun 30 at 16:06
  • $\begingroup$ Just because a password contains plain text and not binary data doesn't mean it's much harder to find a collision for. Of course, OP needs a preimage attack, not a collision attack... $\endgroup$
    – forest
    Jul 3 at 2:17
  • $\begingroup$ Note that the memory complexity of the attack makes it worst than direct brute-force attack ffor MD5. $\endgroup$
    – kelalaka
    Jul 4 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.