[37636] in bugtraq
Re: MD5 To Be Considered Harmful Someday
daemon@ATHENA.MIT.EDU (Joel Maslak)
Wed Dec 8 14:20:45 2004
Date: Tue, 7 Dec 2004 18:51:48 -0700 (MST)
From: Joel Maslak <jmaslak@antelope.net>
To: Gandalf The White <gandalf@digital.net>
Cc: Dan Kaminsky <dan@doxpara.com>, BugTraq <bugtraq@securityfocus.com>
In-Reply-To: <BDDB90CA.19C14%gandalf@digital.net>
Message-ID: <Pine.LNX.4.56.0412071849110.4478@redsky.antelope.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
On Tue, 7 Dec 2004, Gandalf The White wrote:
> >From my reading it appears that you need the original source to create the
> doppelganger blocks. It also appears that given a MD5 hash you could not
> create a input that would give that MD5 back. Passwords encoded with MD5
> would not fall prey to your discovery. Is this correct?
My understanding is similar to yours.
However, imagine a PKI system in, say, a contract management system.
Let's say you can write a valid word document with a section of text that
can be "swapped" out.
That can be a problem. It breaks non-repudiation - someone could create
such a "swappable" contract and go to court and say "Yes, that's a valid
signature, but I really signed *THIS* document which just happens to have
an identical signature." Of course if I was called upon to testify, I
would respond, "Yes, but it is clear this contract was written with the
intent to defraud us, as to get this property, it has to be constructed in
a very specific mind with this fraud in mind at time of contract
origination..."
--
Joel
