Server Help

[Mine GO BOOM]

Note that I did not read the Slashdot article, but instead the SA Thread about it.

Quick summary: They say they can generate a collision within about a hour on a normal computer.

Proof of a collision

Code: Show/Hide   $ cmp file1.bin file2.bin   file1.bin file2.bin differ: byte 20, line 1   $ md5sum file1.bin file2.bin   a4c0d35c95a63a805915367dcfe6b751  file1.bin   a4c0d35c95a63a805915367dcfe6b751  file2.bin

[Mr Ekted]

Scary stuff.
_________________
4,691 irradiated haggis!

[CypherJF]

ITS THE END OF THE WORLD! lol jk
_________________
Performance is often the art of cheating carefully. - James Gosling

[Cyan~Fire]

But didn't we know this all along? It's not like anyone can actually use this to their advantage unless they're really lucky.
_________________
This help is informational only. No representation is made or warranty given as to its content. User assumes all risk of use. Cyan~Fire assumes no responsibility for any loss or delay resulting from such use.
Wise men STILL seek Him.

[Mine GO BOOM]

The idea was that people knew it was weak, and that collisions were possible, but the chance of someone brute-forcing a matching md5 checksum on data the same length was very slim, and would take many years. They claim that they have a formula in which they can find a matching checksum of almost any data within a hour on a normal machine, not some super-computer.

The fact that it only finds a few bytes off can do harm. Take for example, digital signatures. You run something through the md5sum to create a signature of your object for security reasons, but now there is some method in which some other data, the same length, will have the same checksum.

It is unknown if the formula can be repeated on itself, like creating another same-length dataset for the same checksum. And the fact that they state that SH1 has a theoritical weakness is still scary also.

Just so you know, this is the first example of any data stream with matching MD5. So yes, this is a big deal.

[Bak]

So I see the digital signature and accept the email someone signed and sent me. Instead of a message, I get random text, what's the harm again?

[Donkano.]

What makes me wonder is... What is MD5?

[CypherJF]

MD5 is a method supposively that was unique to any key it is given; to create a finger print for the data that is parsed into it. When 2 inputs creates the same output; it's become a problem.

Make sense now? lol

2 files = same MD5 checksum?(hash?), very bad

[myke]

cypher you forgot it means message digest 5 lol