[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: AH-MD5
I just figured out the attack on prepend-only MD5.
Thanks to Perry Metzger for indirectly pointing it out to me.
If I hash "abcd", MD5Transform is invoked once, on the 16 words:
'abcd' 80000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000020
The trailing "20" is the message length in bits (32 bits).
If I have the hash of this, I can compose a message which begins
with this information, then adds another block with additional data,
and compute the hash on the larger message by adding the appropriate
padding and (revised) bit count, and call MD5Transform to convert the
original hash to the hash of the revised message. I can do this even
if I don't know the "ab" authenticator part of the message, but the
recipient who's going to "verify" theh hash does.
In light of this, appending seems safer.
However, it's easier to discover collisions in MD5 if you have the inputs
to the MD5Transform function, which a secret key deprives you of.
One possibility is to place the secret key into its own MD5Transform block,
enabling the output hash from the first block to be precomputed and used
directly. Or change the input "magic constants" directly. This avoids
the extra time overhead.
--
-Colin
Follow-Ups: