Beefy Boxes and Bandwidth Generously Provided by pair Networks
P is for Practical
 
PerlMonks  

Comment on

( #3333=superdoc: print w/ replies, xml ) Need Help??

Maybe I am? Did you find something somewhere that suggested that they could start with an md5 and generate a plaintext with that md5?

What I read, led me to believe that what they were saying is that they had discovered a way to take one piece of plain text, generate its md5, and then by manipulating the original plaintext, generate another plaintext with the same md5.

But note. If I read it right, they need the original text to produce the new one.

For password applications, this means they would need the original password in order to produce another piece of text that had the same md5. But why bother when you have the original password?

So what other vulnerabilities arise from this discovery? If they start with the source or binary of some application that is downloadable and is checksummed with md5. They produce a modified version of that binary with the same md5. Will it run? Will it open a known port and listen for mother? Will it monitor the keyboard for passwords?

Or, they have the text of an important message and it's md5. They produce a different message with the same md5. Will it cause the bank to transfer funds to their bank account? Or recall the nuclear bombers? Instruct the enemies operative in Washington to fall into the counter espionage trap at the cafe? Will it even be readable as English (French, German, Chinese or Swahili)?

If the md5 is being used to stop them from knowing the text it was generated from (password), and they need to know that password to exploit the md5--no vulnerability.

If there is open access to the plaintext, and the md5 is designed to ensure that the plaintext hasn't been altered, they can produce another plaintext with the same md5, but will it make any sense? Never mind actually do anything subversive, or to their advantage.

Maybe I misunderstood what I read? Maybe, there is an application that allows the fact the the alternative plaintext is gibberish to be ignored and compromise something?


Examine what is said, not who speaks.
"Efficiency is intelligent laziness." -David Dunham
"Think for yourself!" - Abigail
"Memory, processor, disk in that order on the hardware side. Algorithm, algorithm, algorithm on the code side." - tachyon

In reply to Re^6: On showing the weakness in the MD5 digest function and getting bitten by scalar context by BrowserUk
in thread On showing the weakness in the MD5 digest function and getting bitten by scalar context by grinder

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":



  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • Outside of code tags, you may need to use entities for some characters:
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.
  • Log In?
    Username:
    Password:

    What's my password?
    Create A New User
    Chatterbox?
    and the web crawler heard nothing...

    How do I use this? | Other CB clients
    Other Users?
    Others musing on the Monastery: (8)
    As of 2014-10-25 19:18 GMT
    Sections?
    Information?
    Find Nodes?
    Leftovers?
      Voting Booth?

      For retirement, I am banking on:










      Results (148 votes), past polls