0

I often hear that MD5 is insecure. But I am not sure how it can be manipulated. I don't want to be the guy who just repeat "MD5 is insecure" without knowing some details.

Say, I have an 128-bits MD5 checksum. And I have a malicious file that is under my control, can a current $5K server generate a "fixer", within a week, that can be appended to the file and yield the same MD5 checksum?

Improve this question

2 Answers 2

Reset to default
3

It depends on exactly what you mean by 'control'.

If you, the attacker, get to choose two files that should have the same hash, that's what cryptographers call a collision (attack) and for MD5 it's now very easy. If you can choose both files freely it takes seconds; if you have to satisfy fairly weak but common constraints like 'it looks like a PDF' or 'it looks like a tar' maybe hours to weeks.

On the other hand if you have one file pre-specified (usually a 'good' one) and you must find another ('bad') file with the same hash, that is not a collision to cryptographers, it is a second preimage. The best known preimage attack on MD5 is only slightly better than brute force at 2123.4.

Your $5k can probably buy half a dozen good GPUs, which gives you somewhere in the vicinity of 237 trials per second (about 100 billion). That is roughly 262 per year, so it will take on average about 260 years (about 1,000,000,000,000,000,000 aka a quintillion). In more convenient terms, that is about a hundred million times the age of the universe. Your computer probably won't last that long.

Improve this answer
2
  • Thank you. The latter case of supplying a bad file with the same hash is what I would consider a successful attack. I think I don't under what good is to choose 2 files that ended up with the same hash. What would be the practical purpose of being able to pick 2 useless file to have same hash? These days, everyone and their dogs are saying MD5 is weak, there has to be some stronger argument?
    – some user
    Apr 27, 2018 at 17:57
  • @someuser See, for example, "MD5 considered harmful today", in which researchers describe how they used MD5's weakness to make a fake certificate with a valid signature. Some applications aren't vulnerable to collision attacks, but in order to be sure the way you're using hashes isn't vulnerable would take a really good understanding of how you're using hashes, and some very careful thinking about possible attacks. And then re-do the analysis every time you change anything. It's much easier, safer, and more flexible to just use a better hash.
    – Gordon Davisson
    Apr 28, 2018 at 1:07
1

The best thing you can do is look at the actual papers in regards to finding MD5 collisions. There are also various tools to do just that. A good answer for this on StackOverflow is Create your own MD5 collisions if you're not interested in reading the paper yourself.

Most collisions finders are probably not interested in finding modifications for files but rather straight on collisions. After all if the MD5 checks out and the users runs the file your malicious file is being run.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .