Re: Thoughts on secure hashing and the "mds" algorithm...
Brad Wilson <[email protected]> Thu, 3 Apr 2014 22:45:32 -0700
| Newsgroups | gmane.comp.windows.off-topic |
|---|---|
| Message-ID | <CAH9GJ-YGa1wB53TXanfBXhHTstSZ1Zs5=zkrYWyXY42Mi7NZgQ@mail.gmail.com> |
--047d7b6783f6e687ea04f6310778 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable You should definitely NOT be using MD5 in this day and age. On Thu, Apr 3, 2014 at 10:32 PM, Kim Gr=C3=A4sman <[email protected]> w= rote: > Hi John, > > I'd try http://crypto.stackexchange.com/, I'm guessing there are lots > of (possibly self-appointed) crypto experts to shoot your idea down > ;-) > > Maybe we have them here too, though... > > - Kim > > On Fri, Apr 4, 2014 at 6:57 AM, John Elliot V <[email protected]> wrote: > > Almost a decade ago Raymond Chen blogged [1] about the "hash reset > > attack" cautioning developers to record the content length in addition > > to the message digest. > > > > Recently I came up with a variation on the MD5 hashing algorithm that > > incorporates the file size. I've called this algorithm 'MDS' for > > 'Message Digest + Size' but hilariously "MDS" is a "cancer" [2]... :P > > > > You can see the javascript [3] or PHP [4] implementation of MDS. > > > > So, is this a good idea? Do you think it would raise the bar for > > collision generation? I'm way out of my depth... sort of seems like a > > good idea, but I'm not armed with facts. > > > > Regards, > > John Elliot V > > > > [1] http://blogs.msdn.com/b/oldnewthing/archive/2004/05/19/134937.aspx > > [2] https://www.google.com/search?q=3Dmds > > [3] https://svn.jj5.net/jjrepo/mds/trunk/src/mds.js > > [4] https://svn.jj5.net/jjrepo/mds/trunk/src/mds.php > > > > > > ------------------------------------ > > > > Yahoo Groups Links > > > > > > > > > ------------------------------------ > > Yahoo Groups Links > > > > --047d7b6783f6e687ea04f6310778 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/htm= l4/strict.dtd"> <html> <head> </head> =20 <body style=3D"background-color: #fff;"> <span style=3D"display:none"> </span> <!--~-|**|PrettyHtmlStartT|**|-~--> <div id=3D"ygrp-mlmsg" style=3D"position:relative;"> <div id=3D"ygrp-msg" style=3D"z-index: 1;"> <!--~-|**|PrettyHtmlEndT|**|-~--> <div id=3D"ygrp-text" > =20=20=20=20=20=20 =20=20=20=20=20=20 <p><div dir=3D"ltr">You should definitely NOT be using MD5 in this da= y and age.<br><div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote= ">On Thu, Apr 3, 2014 at 10:32 PM, Kim Gr=C3=A4sman <span dir=3D"ltr"><<= a href=3D"mailto:[email protected]" target=3D"_blank">kim.grasman@gmail= .com</a>></span> wrote:<br> <blockquote class=3D"gmail_quote" style=3D"border-left:1px #ccc solid;">Hi = John,<br> <br> I'd try <a href=3D"http://crypto.stackexchange.com/" target=3D"_blank">= http://crypto.stackexchange.com/</a>, I'm guessing there are lots<br> of (possibly self-appointed) crypto experts to shoot your idea down<br> ;-)<br> <br> Maybe we have them here too, though...<br> <span class=3D"HOEnZb"><font color=3D"#888888"><br> - Kim<br> </font></span><div class=3D"HOEnZb"><div class=3D"h5"><br> On Fri, Apr 4, 2014 at 6:57 AM, John Elliot V <<a href=3D"mailto:jj5@jj5= .net">[email protected]</a>> wrote:<br> > Almost a decade ago Raymond Chen blogged [1] about the "hash rese= t<br> > attack" cautioning developers to record the content length in add= ition<br> > to the message digest.<br> ><br> > Recently I came up with a variation on the MD5 hashing algorithm that<= br> > incorporates the file size. I've called this algorithm 'MDS= 9; for<br> > 'Message Digest + Size' but hilariously "MDS" is a &= quot;cancer" [2]... :P<br> ><br> > You can see the javascript [3] or PHP [4] implementation of MDS.<br> ><br> > So, is this a good idea? Do you think it would raise the bar for<br> > collision generation? I'm way out of my depth... sort of seems lik= e a<br> > good idea, but I'm not armed with facts.<br> ><br> > Regards,<br> > John Elliot V<br> ><br> > [1] <a href=3D"http://blogs.msdn.com/b/oldnewthing/archive/2004/05/19/= 134937.aspx" target=3D"_blank">http://blogs.msdn.com/b/oldnewthing/archive/= 2004/05/19/134937.aspx</a><br> > [2] <a href=3D"https://www.google.com/search?q=3Dmds" target=3D"_blank= ">https://www.google.com/search?q=3Dmds</a><br> > [3] <a href=3D"https://svn.jj5.net/jjrepo/mds/trunk/src/mds.js" target= =3D"_blank">https://svn.jj5.net/jjrepo/mds/trunk/src/mds.js</a><br> > [4] <a href=3D"https://svn.jj5.net/jjrepo/mds/trunk/src/mds.php" targe= t=3D"_blank">https://svn.jj5.net/jjrepo/mds/trunk/src/mds.php</a><br> ><br> ><br> > ------------------------------------<br> ><br> > Yahoo Groups Links<br> ><br> ><br> ><br> <br> <br> ------------------------------------<br> <br> Yahoo Groups Links<br> <br> <*> To visit your group on the web, go to:<br> =C2=A0 =C2=A0 <a href=3D"http://groups.yahoo.com/group/win_tech_off_topic/"= target=3D"_blank">http://groups.yahoo.com/group/win_tech_off_topic/</a><br= > <br> <*> Your email settings:<br> =C2=A0 =C2=A0 Individual Email | Traditional<br> <br> <*> To change settings online go to:<br> =C2=A0 =C2=A0 <a href=3D"http://groups.yahoo.com/group/win_tech_off_topic/j= oin" target=3D"_blank">http://groups.yahoo.com/group/win_tech_off_topic/joi= n</a><br> =C2=A0 =C2=A0 (Yahoo! ID required)<br> <br> <*> To change settings via email:<br> =C2=A0 =C2=A0 <a href=3D"mailto:win_tech_off_topic-digest-hHKSG33TihhbjbujkaE4pw@public.gmane.org">= win_tech_off_topic-digest-hHKSG33TihhbjbujkaE4pw@public.gmane.org</a><br> =C2=A0 =C2=A0 <a href=3D"mailto:win_tech_off_topic-fullfeatured@yahoogroups= .com">win_tech_off_topic-fullfeatured-hHKSG33TihhbjbujkaE4pw@public.gmane.org</a><br> <br> <*> To unsubscribe from this group, send an email to:<br> =C2=A0 =C2=A0 <a href=3D"mailto:win_tech_off_topic-unsubscribe@yahoogroups.= com">win_tech_off_topic-unsubscribe-hHKSG33TihhbjbujkaE4pw@public.gmane.org</a><br> <br> <*> Your use of Yahoo Groups is subject to:<br> =C2=A0 =C2=A0 <a href=3D"https://info.yahoo.com/legal/us/yahoo/utos/terms/"= target=3D"_blank">https://info.yahoo.com/legal/us/yahoo/utos/terms/</a><br= > <br> </div></div></blockquote></div><br></div></div></div> </p> </div> =20=20=20=20=20 <!--~-|**|PrettyHtmlStart|**|-~--> <div style=3D"color: #fff; height: 0;">__._,_.___</div> =20=20=20=20=20=20=20=20=20=20 =20=20 =20 =20=20=20=20 <div style=3D"clear:both"> </div> <table cellspacing=3D4px style=3D"margin-top: 20px; margin-bottom: 10px= ;"> <tbody> <tr> <td style=3D"font-size: 12px; font-family: arial; font-weight: bo= ld; padding: 7px 5px 5px; color: #FFF; background-color: #F2F2F2; border: 1= px solid #EAEAEA " > <a style=3D"text-decoration: none; color: #2D50FD= " href=3D"https://groups.yahoo.com/neo/groups/win_tech_off_topic/conversati= ons/messages/60520;_ylc=3DX3oDMTJxOWpibHQzBF9TAzk3MzU5NzE0BGdycElkAzM3MDE1M= jQEZ3Jwc3BJZAMxNzA1MDA2NjY5BG1zZ0lkAzYwNTIwBHNlYwNmdHIEc2xrA3JwbHkEc3RpbWUD= MTM5NjU5MDM1NA--?act=3Dreply&messageNum=3D60520">Reply via web post</a> </td> <td style=3D"font-size: 12px; font-family: arial; padding: 7px 5p= x 5px; color: #FFF; background-color: #F2F2F2; border: 1px solid #EAEAEA; "= > <a href=3D"mailto:[email protected]?subject=3DRe%3A%20%5BOT%5= D%20Thoughts%20on%20secure%20hashing%20and%20the%20%22mds%22%20algorithm%2E= %2E%2E" style=3D"text-decoration: none; color: #2D50FD;"> Reply to sender </a>=20 </td> <td style=3D"font-size: 12px; font-family: arial; padding: 7px 5p= x 5px; color: #FFF; background-color: #F2F2F2; border: 1px solid #EAEAEA; "= > <a href=3D"mailto:[email protected]?subject=3D= Re%3A%20%5BOT%5D%20Thoughts%20on%20secure%20hashing%20and%20the%20%22mds%22= %20algorithm%2E%2E%2E" style=3D"text-decoration: none; color: #2D50FD"> Reply to group </a>=20 </td> <td style=3D"font-size: 12px; font-family: arial; padding: 7px 5p= x 5px; color: #FFF; background-color: #F2F2F2; border: 1px solid #EAEAEA; "= > <a href=3D"https://groups.yahoo.com/neo/groups/win_tech_off_top= ic/conversations/newtopic;_ylc=3DX3oDMTJlZWZxaG05BF9TAzk3MzU5NzE0BGdycElkAz= M3MDE1MjQEZ3Jwc3BJZAMxNzA1MDA2NjY5BHNlYwNmdHIEc2xrA250cGMEc3RpbWUDMTM5NjU5M= DM1NA--" style=3D"text-decoration: none; color: #2D50FD">Start a New Topic<= /a> </td> <td style=3D"font-size: 12px; font-family: arial; padding: 7px 5p= x 5px; color: #2D50FD; background-color: #F2F2F2; border: 1px solid #EAEAEA= ; " > <a href=3D"https://groups.yahoo.com/neo/groups/= win_tech_off_topic/conversations/topics/60518;_ylc=3DX3oDMTM2NHEzYmgyBF9TAz= k3MzU5NzE0BGdycElkAzM3MDE1MjQEZ3Jwc3BJZAMxNzA1MDA2NjY5BG1zZ0lkAzYwNTIwBHNlY= wNmdHIEc2xrA3Z0cGMEc3RpbWUDMTM5NjU5MDM1NAR0cGNJZAM2MDUxOA--" style=3D"text-= decoration: none; color: #2D50FD;">Messages in this topic</a> (3) </td> </tr> </tbody> </table> =20=20=20=20=20=20=20=20 <!------- Start Nav Bar ------> =20 <!-- |**|begin egp html banner|**| --> <div id=3D"ygrp-vital" style=3D"background-color: #f2f2f2; font-family: Ver= dana; font-size: 10px; margin-bottom: 10px; padding: 10px;"> <span id=3D"vithd" style=3D"font-weight: bold; color: #333; text-transf= orm: uppercase; "><a href=3D"https://groups.yahoo.com/neo/groups/win_tech_o= ff_topic/info;_ylc=3DX3oDMTJlbnFhMGdsBF9TAzk3MzU5NzE0BGdycElkAzM3MDE1MjQEZ3= Jwc3BJZAMxNzA1MDA2NjY5BHNlYwN2dGwEc2xrA3ZnaHAEc3RpbWUDMTM5NjU5MDM1NA--" sty= le=3D"text-decoration: none;">Visit Your Group</a></span> <ul style=3D"list-style-type: none; margin: 0; padding: 0; display: in= line;"> </ul> </div> <div id=3D"ft" style=3D"font-family: Arial; font-size: 11px; margin-top: 5p= x; padding: 0 2px 0 0; clear: both;"> <a href=3D"https://groups.yahoo.com/neo;_ylc=3DX3oDMTJkNHY4bm91BF9TAzk3ND= c2NTkwBGdycElkAzM3MDE1MjQEZ3Jwc3BJZAMxNzA1MDA2NjY5BHNlYwNmdHIEc2xrA2dmcARzd= GltZQMxMzk2NTkwMzU0" style=3D"float: left;"><img src=3D"http://l.yimg.com/r= u/static/images/yg/img/email/new_logo/logo-groups-137x15.png" height=3D"15"= width=3D"137" alt=3D"Yahoo! Groups" style=3D"border: 0;"/></a> <div style=3D"color: #747575; float: right;"> • <a href=3D"https://i= nfo.yahoo.com/privacy/us/yahoo/groups/details.html" style=3D"text-decoratio= n: none;">Privacy</a> • <a href=3D"mailto:win_tech_off_topic-unsubscri= [email protected]?subject=3DUnsubscribe" style=3D"text-decoration: none;">= Unsubscribe</a> • <a href=3D"https://info.yahoo.com/legal/us/yahoo/uto= s/terms/" style=3D"text-decoration: none;">Terms of Use</a> </div> </div> <!-- |**|end egp html banner|**| --> </div> <!-- ygrp-msg --> =20 <!-- Sponsor --> <!-- |**|begin egp html banner|**| --> <div id=3D"ygrp-sponsor" style=3D"width:160px; float:right; clear:none; m= argin:0 0 25px 0; background: #fff;"> <!-- Start Recommendations --> <div id=3D"ygrp-reco"> </div> <!-- End Recommendations --> </div> <!-- |**|end egp html banner|**| --> <div style=3D"clear:both; color: #FFF; font-size:1px;">.</div> </div> <img src=3D"http://geo.yahoo.com/serv?s=3D97359714/grpId=3D3701524/grpspI= d=3D1705006669/msgId=3D60520/stime=3D1396590354" width=3D"1" height=3D"1"> = <br> <div style=3D"color: #fff; height: 0;">__,_._,___</div> <!--~-|**|PrettyHtmlEnd|**|-~--> </body> <!--~-|**|PrettyHtmlStart|**|-~--> <head> <style type=3D"text/css"> <!-- #ygrp-mkp { border: 1px solid #d8d8d8; font-family: Arial; margin: 10px 0; padding: 0 10px; } #ygrp-mkp hr { border: 1px solid #d8d8d8; } #ygrp-mkp #hd { color: #628c2a; font-size: 85%; font-weight: 700; line-height: 122%; margin: 10px 0; } #ygrp-mkp #ads { margin-bottom: 10px; } #ygrp-mkp .ad { padding: 0 0; } #ygrp-mkp .ad p { margin: 0; } #ygrp-mkp .ad a { color: #0000ff; text-decoration: none; } #ygrp-sponsor #ygrp-lc { font-family: Arial; } #ygrp-sponsor #ygrp-lc #hd { margin: 10px 0px; font-weight: 700; font-size: 78%; line-height: 122%; } #ygrp-sponsor #ygrp-lc .ad { margin-bottom: 10px; padding: 0 0; } #actions { font-family: Verdana; font-size: 11px; padding: 10px 0; } #activity { background-color: #e0ecee; float: left; font-family: Verdana; font-size: 10px; padding: 10px; } #activity span { font-weight: 700; } #activity span:first-child { text-transform: uppercase; } #activity span a { color: #5085b6; text-decoration: none; } #activity span span { color: #ff7900; } #activity span .underline { text-decoration: underline; } .attach { clear: both; display: table; font-family: Arial; font-size: 12px; padding: 10px 0; width: 400px; } .attach div a { text-decoration: none; } .attach img { border: none; padding-right: 5px; } .attach label { display: block; margin-bottom: 5px; } .attach label a { text-decoration: none; } =20=20 blockquote { margin: 0 0 0 4px; } .bold { font-family: Arial; font-size: 13px; font-weight: 700; } .bold a { text-decoration: none; } dd.last p a { font-family: Verdana; font-weight: 700; } dd.last p span { margin-right: 10px; font-family: Verdana; font-weight: 700; } dd.last p span.yshortcuts { margin-right: 0; } div.attach-table div div a { text-decoration: none; } div.attach-table { width: 400px; } div.file-title a, div.file-title a:active, div.file-title a:hover, div.fi= le-title a:visited { text-decoration: none; } div.photo-title a, div.photo-title a:active, div.photo-title a:hover, div= .photo-title a:visited { text-decoration: none; } div#ygrp-mlmsg #ygrp-msg p a span.yshortcuts { font-family: Verdana; font-size: 10px; font-weight: normal; } .green { color: #628c2a; } .MsoNormal { margin: 0 0 0 0; } o { font-size: 0; } #photos div { float: left; width: 72px; } #photos div div { border: 1px solid #666666; height: 62px; overflow: hidden; width: 62px; } #photos div label { color: #666666; font-size: 10px; overflow: hidden; text-align: center; white-space: nowrap; width: 64px; } #reco-category { font-size: 77%; } #reco-desc { font-size: 77%; } .replbq { margin: 4px; } #ygrp-actbar div a:first-child { /* border-right: 0px solid #000;*/ margin-right: 2px; padding-right: 5px; } #ygrp-mlmsg { font-size: 13px; font-family: Arial, helvetica,clean, sans-serif; *font-size: small; *font: x-small; } #ygrp-mlmsg table { font-size: inherit; font: 100%; } #ygrp-mlmsg select, input, textarea { font: 99% Arial, Helvetica, clean, sans-serif; } #ygrp-mlmsg pre, code { font:115% monospace; *font-size:100%; } #ygrp-mlmsg * { line-height: 1.22em; } #ygrp-mlmsg #logo { padding-bottom: 10px; } #ygrp-msg p a { font-family: Verdana; } #ygrp-msg p#attach-count span { color: #1E66AE; font-weight: 700; } #ygrp-reco #reco-head { color: #ff7900; font-weight: 700; } #ygrp-reco { margin-bottom: 20px; padding: 0px; } #ygrp-sponsor #ov li a { font-size: 130%; text-decoration: none; } #ygrp-sponsor #ov li { font-size: 77%; list-style-type: square; padding: 6px 0; }=20 #ygrp-sponsor #ov ul { margin: 0; padding: 0 0 0 8px; } #ygrp-text { font-family: Georgia; } #ygrp-text p { margin: 0 0 1em 0; } #ygrp-text tt { font-size: 120%; } #ygrp-vital ul li:last-child { border-right: none !important;=20 }=20 --> </style> </head> <!--~-|**|PrettyHtmlEnd|**|-~--> </html> <!-- end group email --> --047d7b6783f6e687ea04f6310778--