Hot answers tagged

68 votes

Are there two known strings which have the same MD5 hash value?

Just to show you how easy it is today to create collisions on MD5: One could create collisions using Marc Steven's HashClash on AWS and estimated the the cost of around $0.65 per collision. ...
Silverfox's user avatar
  • 851
61 votes
Accepted

How can hashes be unique if they are limited in number?

how can for example SHA-256 be unique if there is only a limited number of them?! Where your issue occurs is that they're not unique. It's just very improbable that they'll reoccur. Unique in ...
Paul Uszak's user avatar
  • 15.2k
56 votes
Accepted

For a hashing function like MD5, how similar can two plaintext strings be and still generate the same hash?

This answer is based on the work by AleksanderRas, although my conclusion is different. First, to lay out a definition, a hash is a function that takes an arbitrary length input to a fixed length ...
Josiah's user avatar
  • 1,032
36 votes
Accepted

How are the functions used in cryptographic hash functions chosen?

The functions considered are binary functions of 3 bits to 1 bit (extended to bit vectors, that is bitwise functions). There are $2^{(2^3)}=256$ such functions. All the functions considered are ...
fgrieu's user avatar
  • 138k
34 votes
Accepted

Is there really no use for MD5 anymore?

I know that MD5 should not be used for password hashing, and that it also should not be used for integrity checking of documents. There are way too many sources citing MD5 preimaging attacks and MD5s ...
Squeamish Ossifrage's user avatar
31 votes

How can hashes be unique if they are limited in number?

You are right, hashes won't be all unique as you already have shown. The important part are practical collisions - how many SHA-512 hashes can the whole earth generate in its lifetime? Definitely much ...
Nova's user avatar
  • 3,870
26 votes
Accepted

Could we break MD5 entirely in the future?

If you follow the reference for the alleged preimage attack on MD5, you will see that although the time cost is $2^{123.4}$ steps, the memory cost is $2^{45} \times 11$ words of memory, which has a ...
Squeamish Ossifrage's user avatar
22 votes

For a hashing function like MD5, how similar can two plaintext strings be and still generate the same hash?

The answer is 1 bit (Hamming-distance = 1) for any cryptographic hash algorithm. There are definitely collisions, since the digest of the MD5 algorithm is always 128 bits long but there are more than ...
AleksanderCH's user avatar
  • 6,405
20 votes
Accepted

How hard is it to generate a simultaneous MD5 and SHA1 collision?

Surprisingly enough, it would appear that generating a simultaneous collision wouldn't be that much more expensive than generating a single collision for SHA-1. The basic idea is to form a $2^{64}$ ...
poncho's user avatar
  • 145k
20 votes
Accepted

Does a hash function have a Upper bound on input length?

Does hashing algorithms have an upper bound in the input space? They can, but they don't have to and it depends on their specification. All Merkle-Damgård based hash functions do have an upper limit,...
SEJPM's user avatar
  • 45.7k
19 votes
Accepted

Is a password cyphered by itself as secure as hash?

There is an important misconception on your part: in general cryptographic hashes such as MD5, SHA-1 or SHA-512 should not be used to directly hash a password. A password hash or PBKDF should be used. ...
Maarten Bodewes's user avatar
  • 91.9k
16 votes

For a hashing function like MD5, how similar can two plaintext strings be and still generate the same hash?

There are two answers to this: one practical, and one theoretical. First, the practical one: MD5 is a broken hash function, and we know of collisions for it, and a quick web search turned up a ...
James_pic's user avatar
  • 372
14 votes
Accepted

How does the attack on MD5 work that allows a file to show its own (full) hash?

TO understand what is going on, you have to consider how MD5 works and how the collision attack works. MD5 is a Merkle-Damgård hash function: it process the input data by blocks (of 64 bytes each), ...
Thomas Pornin's user avatar
13 votes
Accepted

Advantages/disadvantages of using symmetric encryption function as hash function?

The disadvantage of this approach is that block ciphers are not necessarily designed with this goal in mind. Specifically, AES has related-key problems, and DES completely breaks in Davies-Meyer. In ...
Yehuda Lindell's user avatar
13 votes
Accepted

How many trials does it take to break HMAC-MD5?

You can find a collision in MD5 at much lower cost than $2^{64}$ evaluations of MD5. You could do the same for HMAC-MD5, if you knew the key, which renders it unfit for unusual applications such as ...
Squeamish Ossifrage's user avatar
12 votes

For a hashing function like MD5, how similar can two plaintext strings be and still generate the same hash?

An important aspect of cryptographic hash functions is that even the smallest difference in input usually results in different output. But given the unlimited input space compared to the limited ...
Steffen Ullrich's user avatar
11 votes
Accepted

Is it possible to make two files with the same size and the same MD5 and CRC32?

Is it possible to make two files with the same size and the same MD5 and CRC32? It's straight-forward. First off, we start with Joux's multicollision attack (PDF) to generate $2^{33}$ different same-...
poncho's user avatar
  • 145k
11 votes

How easy is it to fake a file hashed with three functions, CRC32, MD5 and SHA-1?

How easy is it to create a fake file-b that has the same hashes of file-a? crc32, md5 and sha1? This is known in cryptographical circles as the 'second preimage' problem. With CRC32, it's easy; just ...
poncho's user avatar
  • 145k
10 votes

Is the SHA1 hash of MD5 hash of a password secure?

Pros: The only pro is that your method is very slightly better than storing passwords in plaintext. Cons: If an attacker gains access to your database, he will easily be able to recover 99% of ...
bkjvbx's user avatar
  • 1,554
10 votes

Can SHA or MD5 results be decrypted?

MD5, SHA-1, SHA-256, etc. are one-way functions: given the hash of an input, nobody knows how to find the input better than by guessing, and the best cryptographers in the world have tried. But ...
Gilles 'SO- stop being evil''s user avatar
10 votes

Why aren't hash values for "nothing" (empty) defined as all zeros?

Why would that be a convenient property? It would be pretty annoying if I would test an empty string input, hash that and then XOR it with a value. I would get the same value back. You want the output ...
Maarten Bodewes's user avatar
  • 91.9k
10 votes

Is there really no use for MD5 anymore?

But what does it mean when it says that "[MD5 is] too slow to use as a general purpose hash"? Are there faster standardized hashes to compare files, that still have a reasonably low chance of ...
DannyNiu's user avatar
  • 9,001
9 votes

Is the SHA1 hash of MD5 hash of a password secure?

The short answer DO NOT DO THAT. It is not secure. The long answer Background There are three main types of attacks against password based systems: Guessing (e.g. birth date of the person, wife's ...
istvanlam's user avatar
  • 311
9 votes

How can hashes be unique if they are limited in number?

A 256-bit hash has about one million times as many numbers as the Milky Way has atoms (give or take a few hundred atoms...). So that's not just a limited number, it's a pretty big limited number. ...
Damon's user avatar
  • 918
9 votes
Accepted

Using weak hash functions to construct a stream cipher

As long as your encoding of $K$, $N$, and $i$ is injective (i.e., for each encoded string you can uniquely derive $K$, $N$, and $i$) and fixed-length, this is almost certainly a decent stream cipher. ...
Squeamish Ossifrage's user avatar
9 votes
Accepted

MD5: Existence of invariant (fixed point)

It is not known a practical method to find a 128-bit $B$ such that $\operatorname{MD5}(B)=B$. Argument: that's essentially a first-preimage attack against a variant of MD5 defined as $H(B)=\...
fgrieu's user avatar
  • 138k
8 votes

How many trials does it take to break HMAC-MD5?

We can find collisions in MD5 much easier than via a generic birthday attack, due to flaws discovered in it's construction. However no practical preimage attack is known, and no practical attack on ...
Meir Maor's user avatar
  • 11.7k
8 votes
Accepted

Is it feasible to get a hash collision for CRC32, MD-5 and SHA-1 on one file?

Finding a simultaneous collision for all three would take the effort of approximately $2^{72}$ SHA-1 compression function evaluations. The overall idea would be to take the general $2^{67}$ idea ...
poncho's user avatar
  • 145k

Only top scored, non community-wiki answers of a minimum length are eligible