MD5 and SHA cracked/broken...

[John Roth]

"Tim Churches" <tchur at optushome.com.au> wrote in message 
news:mailman.3198.1094942493.5135.python-list at python.org...
> On Sun, 2004-09-12 at 02:59, Magnus Lie Hetland wrote:
>> Basically, at Crypto 2004 preliminary papers were presented that
>> pointed out weaknesses in MD5, SHA-0 and SHA-1. As far as I can tell,
>> MD5 is broken and SHA-1 seems to be in a precarious position (even
>> though I don't know the details at all).
>
> IANAC, but it is important to keep in mind that only one aspect of MD-5
> and a weakened version of SHA were "broken": collision resistance. My
> understanding is that the other important qualities of a cryptographic
> has function, preimage resistance and 2nd preimage resistance, were not
> assailed.
>
> Collision resistance is how difficult it is to find two input values
> which produce the same has value. Weakened collision resistance
> undermines digital signatures (at least in theory - practical attacks
> may still be difficult).
>
> Preimage resistance measures the difficulty of finding an input which
> results in a particular hash value. You don't know the original input.
> Poor preimage resistance undermines the security of hashed passwords and
> similar uses.
>
> 2nd preimage resistance is the difficulty of finding an input which
> hashes to the same value that some other given input hashes to. Like
> preimage resistance but you do know the other input value. How is this
> different to collision resistance? Collision resistance is the
> difficulty of finding ANY two inputs which hash to the same but
> arbitrary output value, whereas preimage resistance and 2nd preimage
> resistance are about finding input values which hash to a PARTICULAR
> output value. Clearly that's much harder, and the recently reported work
> didn't address that issue, I think.

And that, of course, is the critical issue for such applications as 
verifying
that a download is intact.

John Roth
>
> -- 
>
> Tim C
>
> PGP/GnuPG Key 1024D/EAF993D0 available from keyservers everywhere
> or at http://members.optushome.com.au/tchur/pubkey.asc
> Key fingerprint = 8C22 BF76 33BA B3B5 1D5B  EB37 7891 46A9 EAF9 93D0
>
>
>