RE: Thoughts on secure hashing and the "mds" algorithm...

"Richard Howells" <[email protected]> Fri, 4 Apr 2014 19:22:28 +0100
Newsgroups	gmane.comp.windows.off-topic
Message-ID	<[email protected]>
------=_NextPart_000_0079_01CF503B.3B1C59C0
Content-Type: multipart/alternative;
 boundary="----=_NextPart_001_007A_01CF503B.3B1C59C0"

------=_NextPart_001_007A_01CF503B.3B1C59C0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

You did read the comments in the original blog post.  It seems the length is
*already* in there.

 

Best wishes,

 

Richard Howells

 

 <mailto:richard-yP/[email protected]> richard-yP/[email protected]

 <http://www.dynamisys.co.uk/> www.dynamisys.co.uk

L: +44 (0)1793 731225

M: +44 (0)7769 266522

 

From: [email protected]
[mailto:[email protected]] On Behalf Of John Elliot V
Sent: 04 April 2014 18:52
To: [email protected]
Subject: Re: [OT] Thoughts on secure hashing and the "mds" algorithm...

 

  

I haven't given up yet! :P

Here's a revision which masks the content length:

https://svn.jj5.net/jjrepo/mds/trunk/src/mds.php

So that fixes that problem.

It might not be perfect but I'm pretty sure this algorithm negates the
possibility of what Mr Chen called the "hash reset attack". Finding a
collision with the same content length will be much harder.

Also, seeing as though I'm the only one who'll be using it, I can assume
no-one will bother cracking it! :)

Regards,
John Elliot V




------=_NextPart_001_007A_01CF503B.3B1C59C0
Content-Type: text/html; charset=US-ASCII
Content-Transfer-Encoding: 7bit




<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
</head>






 
<body style="background-color: #fff;">
<span style="display:none">&nbsp;</span>

<!--~-|**|PrettyHtmlStartT|**|-~-->
<div id="ygrp-mlmsg" style="position:relative;">
  <div id="ygrp-msg" style="z-index: 1;">
<!--~-|**|PrettyHtmlEndT|**|-~-->

    <div id="ygrp-text" >
      
      
      <p><div class="WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;">You did read the comments in the original blog post.&nbsp; It seems the length is *<b>already</b>* in there.<o></o></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;"><o>&nbsp;</o></span></p><div><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;">Best wishes,<o></o></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;"><o>&nbsp;</o></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;">Richard Howells<o></o></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;"><o>&nbsp;</o></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;"><a href="mailto:richard@dynami
 sys.co.uk"><span style="color:blue;">richard-yP/[email protected]</span></a><o></o></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;"><a href="http://www.dynamisys.co.uk/"><span style="color:blue;">www.dynamisys.co.uk</span></a><o></o></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;">L: &#43;44 (0)1793 731225<o></o></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;">M: &#43;44 (0)7769 266522<o></o></span></p></div><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D;"><o>&nbsp;</o></span></p><div><div style="border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm;"><p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;">From:</span></b><span lang="EN-US" style="font-size:10.0pt;"> win_te
 [email protected] [mailto:[email protected]] <b>On Behalf Of </b>John Elliot V<br><b>Sent:</b> 04 April 2014 18:52<br><b>To:</b> [email protected]<br><b>Subject:</b> Re: [OT] Thoughts on secure hashing and the &quot;mds&quot; algorithm...<o></o></span></p></div></div><p class="MsoNormal"><o>&nbsp;</o></p><p class="MsoNormal">&nbsp; <o></o></p><div id="ygrp-mlmsg"><div id="ygrp-msg"><div id="ygrp-text"><p>I haven't given up yet! :P<br><br>Here's a revision which masks the content length:<br><br>https://svn.jj5.net/jjrepo/mds/trunk/src/mds.php<br><br>So that fixes that problem.<br><br>It might not be perfect but I'm pretty sure this algorithm negates the<br>possibility of what Mr Chen called the &quot;hash reset attack&quot;. Finding a<br>collis
 ion with the same content length will be much harder.<br><br>Also, seeing as though I'm the only one who'll be using it, I can assume<br>no-one will bother cracking it! :)<br><br>Regards,<br>John Elliot V<o></o></p></div><div><p class="MsoNormal"><span style="color:white;"><o></o></span></p></div></div></div></div></p>

    </div>
     

    <!--~-|**|PrettyHtmlStart|**|-~-->
    <div style="color: #fff; height: 0;">__._,_.___</div>

          
  
 

    
    <div style="clear:both"> </div>

    <table cellspacing=4px style="margin-top: 20px; margin-bottom: 10px;">
      <tbody>
        <tr>
          <td style="font-size: 12px; font-family: arial; font-weight: bold; padding: 7px 5px 5px; color: #FFF; background-color: #F2F2F2; border: 1px solid #EAEAEA "  >
                          <a style="text-decoration: none; color: #2D50FD" href="https://groups.yahoo.com/neo/groups/win_tech_off_topic/conversations/messages/60526;_ylc=X3oDMTJxZjNiaXZmBF9TAzk3MzU5NzE0BGdycElkAzM3MDE1MjQEZ3Jwc3BJZAMxNzA1MDA2NjY5BG1zZ0lkAzYwNTI2BHNlYwNmdHIEc2xrA3JwbHkEc3RpbWUDMTM5NjYzNTc1OQ--?act=reply&messageNum=60526">Reply via web post</a>
                      </td>
          <td style="font-size: 12px; font-family: arial; padding: 7px 5px 5px; color: #FFF; background-color: #F2F2F2; border: 1px solid #EAEAEA; " >
            <a href="mailto:richard-yP/[email protected]?subject=RE%3A%20%5BOT%5D%20Thoughts%20on%20secure%20hashing%20and%20the%20%22mds%22%20algorithm%2E%2E%2E" style="text-decoration: none; color: #2D50FD;">
              Reply to sender            </a> 
          </td>
          <td style="font-size: 12px; font-family: arial; padding: 7px 5px 5px; color: #FFF; background-color: #F2F2F2; border: 1px solid #EAEAEA; ">
            <a href="mailto:[email protected]?subject=RE%3A%20%5BOT%5D%20Thoughts%20on%20secure%20hashing%20and%20the%20%22mds%22%20algorithm%2E%2E%2E" style="text-decoration: none; color: #2D50FD">
              Reply to group            </a> 
          </td>
          <td style="font-size: 12px; font-family: arial; padding: 7px 5px 5px; color: #FFF; background-color: #F2F2F2; border: 1px solid #EAEAEA; " >
            <a href="https://groups.yahoo.com/neo/groups/win_tech_off_topic/conversations/newtopic;_ylc=X3oDMTJlOGlqMHJvBF9TAzk3MzU5NzE0BGdycElkAzM3MDE1MjQEZ3Jwc3BJZAMxNzA1MDA2NjY5BHNlYwNmdHIEc2xrA250cGMEc3RpbWUDMTM5NjYzNTc1OQ--" style="text-decoration: none; color: #2D50FD">Start a New Topic</a>
          </td>
          <td style="font-size: 12px; font-family: arial; padding: 7px 5px 5px; color: #2D50FD; background-color: #F2F2F2; border: 1px solid #EAEAEA; " >
                            <a href="https://groups.yahoo.com/neo/groups/win_tech_off_topic/conversations/topics/60518;_ylc=X3oDMTM2YWFiZ3JtBF9TAzk3MzU5NzE0BGdycElkAzM3MDE1MjQEZ3Jwc3BJZAMxNzA1MDA2NjY5BG1zZ0lkAzYwNTI2BHNlYwNmdHIEc2xrA3Z0cGMEc3RpbWUDMTM5NjYzNTc1OQR0cGNJZAM2MDUxOA--" style="text-decoration: none; color: #2D50FD;">Messages in this topic</a>
                (9)
                      </td>
        </tr>
      </tbody>
    </table>

        
<!------- Start Nav Bar ------>




 

<!-- |**|begin egp html banner|**| -->
<div id="ygrp-vital" style="background-color: #f2f2f2; font-family: Verdana; font-size: 10px; margin-bottom: 10px; padding: 10px;">

    <span id="vithd" style="font-weight: bold; color: #333; text-transform: uppercase; "><a href="https://groups.yahoo.com/neo/groups/win_tech_off_topic/info;_ylc=X3oDMTJlZGc0bGpkBF9TAzk3MzU5NzE0BGdycElkAzM3MDE1MjQEZ3Jwc3BJZAMxNzA1MDA2NjY5BHNlYwN2dGwEc2xrA3ZnaHAEc3RpbWUDMTM5NjYzNTc1OQ--" style="text-decoration: none;">Visit Your Group</a></span>

     <ul style="list-style-type: none; margin: 0; padding: 0; display: inline;">
                                                    </ul>
  </div>


<div id="ft" style="font-family: Arial; font-size: 11px; margin-top: 5px; padding: 0 2px 0 0; clear: both;">
  <a href="https://groups.yahoo.com/neo;_ylc=X3oDMTJkczY4OXM0BF9TAzk3NDc2NTkwBGdycElkAzM3MDE1MjQEZ3Jwc3BJZAMxNzA1MDA2NjY5BHNlYwNmdHIEc2xrA2dmcARzdGltZQMxMzk2NjM1NzU5" style="float: left;"><img src="http://l.yimg.com/ru/static/images/yg/img/email/new_logo/logo-groups-137x15.png" height="15" width="137" alt="Yahoo! Groups" style="border: 0;"/></a>
  <div style="color: #747575; float: right;"> &bull; <a href="https://info.yahoo.com/privacy/us/yahoo/groups/details.html" style="text-decoration: none;">Privacy</a> &bull; <a href="mailto:win_tech_off_topic-unsubscribe-hHKSG33TihhbjbujkaE4pw@public.gmane.org?subject=Unsubscribe" style="text-decoration: none;">Unsubscribe</a> &bull; <a href="https://info.yahoo.com/legal/us/yahoo/utos/terms/" style="text-decoration: none;">Terms of Use</a> </div>
</div>

<!-- |**|end egp html banner|**| -->

  </div> <!-- ygrp-msg -->

 
  <!-- Sponsor -->
  <!-- |**|begin egp html banner|**| -->
  <div id="ygrp-sponsor" style="width:160px; float:right; clear:none; margin:0 0 25px 0; background: #fff;">

<!-- Start Recommendations -->
<div id="ygrp-reco">
     </div>
<!-- End Recommendations -->



  </div>   <!-- |**|end egp html banner|**| -->

  <div style="clear:both; color: #FFF; font-size:1px;">.</div>
</div>

  <img src="http://geo.yahoo.com/serv?s=97359714/grpId=3701524/grpspId=1705006669/msgId=60526/stime=1396635759" width="1" height="1"> <br>

<div style="color: #fff; height: 0;">__,_._,___</div>
<!--~-|**|PrettyHtmlEnd|**|-~-->

</body>

<!--~-|**|PrettyHtmlStart|**|-~-->
<head>
  <style type="text/css">
  <!--
  #ygrp-mkp {
  border: 1px solid #d8d8d8;
  font-family: Arial;
  margin: 10px 0;
  padding: 0 10px;
}

#ygrp-mkp hr {
  border: 1px solid #d8d8d8;
}

#ygrp-mkp #hd {
  color: #628c2a;
  font-size: 85%;
  font-weight: 700;
  line-height: 122%;
  margin: 10px 0;
}

#ygrp-mkp #ads {
  margin-bottom: 10px;
}

#ygrp-mkp .ad {
  padding: 0 0;
}

#ygrp-mkp .ad p {
  margin: 0;
}

#ygrp-mkp .ad a {
  color: #0000ff;
  text-decoration: none;
}
  #ygrp-sponsor #ygrp-lc {
  font-family: Arial;
}

#ygrp-sponsor #ygrp-lc #hd {
  margin: 10px 0px;
  font-weight: 700;
  font-size: 78%;
  line-height: 122%;
}

#ygrp-sponsor #ygrp-lc .ad {
  margin-bottom: 10px;
  padding: 0 0;
}

  #actions {
    font-family: Verdana;
    font-size: 11px;
    padding: 10px 0;
  }

  #activity {
    background-color: #e0ecee;
    float: left;
    font-family: Verdana;
    font-size: 10px;
    padding: 10px;
  }

  #activity span {
    font-weight: 700;
  }

  #activity span:first-child {
    text-transform: uppercase;
  }

  #activity span a {
    color: #5085b6;
    text-decoration: none;
  }

  #activity span span {
    color: #ff7900;
  }

  #activity span .underline {
    text-decoration: underline;
  }

  .attach {
    clear: both;
    display: table;
    font-family: Arial;
    font-size: 12px;
    padding: 10px 0;
    width: 400px;
  }

  .attach div a {
    text-decoration: none;
  }

  .attach img {
    border: none;
    padding-right: 5px;
  }

  .attach label {
    display: block;
    margin-bottom: 5px;
  }

  .attach label a {
    text-decoration: none;
  }
  
  blockquote {
    margin: 0 0 0 4px;
  }

  .bold {
    font-family: Arial;
    font-size: 13px;
    font-weight: 700;
  }

  .bold a {
    text-decoration: none;
  }

  dd.last p a {
    font-family: Verdana;
    font-weight: 700;
  }

  dd.last p span {
    margin-right: 10px;
    font-family: Verdana;
    font-weight: 700;
  }

  dd.last p span.yshortcuts {
    margin-right: 0;
  }

  div.attach-table div div a {
    text-decoration: none;
  }

  div.attach-table {
    width: 400px;
  }

  div.file-title a, div.file-title a:active, div.file-title a:hover, div.file-title a:visited {
    text-decoration: none;
  }

  div.photo-title a, div.photo-title a:active, div.photo-title a:hover, div.photo-title a:visited {
    text-decoration: none;
  }

  div#ygrp-mlmsg #ygrp-msg p a span.yshortcuts {
    font-family: Verdana;
    font-size: 10px;
    font-weight: normal;
  }

  .green {
    color: #628c2a;
  }

  .MsoNormal {
    margin: 0 0 0 0;
  }

  o {
    font-size: 0;
  }

  #photos div {
    float: left;
    width: 72px;
  }

  #photos div div {
    border: 1px solid #666666;
    height: 62px;
    overflow: hidden;
    width: 62px;
  }

  #photos div label {
    color: #666666;
    font-size: 10px;
    overflow: hidden;
    text-align: center;
    white-space: nowrap;
    width: 64px;
  }

  #reco-category {
    font-size: 77%;
  }

  #reco-desc {
    font-size: 77%;
  }

  .replbq {
    margin: 4px;
  }

  #ygrp-actbar div a:first-child {
   /* border-right: 0px solid #000;*/
    margin-right: 2px;
    padding-right: 5px;
  }

  #ygrp-mlmsg {
    font-size: 13px;
    font-family: Arial, helvetica,clean, sans-serif;
    *font-size: small;
    *font: x-small;
  }

  #ygrp-mlmsg table {
    font-size: inherit;
    font: 100%;
  }

  #ygrp-mlmsg select, input, textarea {
    font: 99% Arial, Helvetica, clean, sans-serif;
  }

  #ygrp-mlmsg pre, code {
    font:115% monospace;
    *font-size:100%;
  }

  #ygrp-mlmsg * {
    line-height: 1.22em;
  }

  #ygrp-mlmsg #logo {
    padding-bottom: 10px;
  }


  #ygrp-msg p a {
    font-family: Verdana;
  }

  #ygrp-msg p#attach-count span {
    color: #1E66AE;
    font-weight: 700;
  }

  #ygrp-reco #reco-head {
    color: #ff7900;
    font-weight: 700;
  }

  #ygrp-reco {
    margin-bottom: 20px;
    padding: 0px;
  }

  #ygrp-sponsor #ov li a {
    font-size: 130%;
    text-decoration: none;
  }

  #ygrp-sponsor #ov li {
    font-size: 77%;
    list-style-type: square;
    padding: 6px 0;
  } 

  #ygrp-sponsor #ov ul {
    margin: 0;
    padding: 0 0 0 8px;
  }

  #ygrp-text {
    font-family: Georgia;
  }

  #ygrp-text p {
    margin: 0 0 1em 0;
  }

  #ygrp-text tt {
    font-size: 120%;
  }

  #ygrp-vital ul li:last-child {
    border-right: none !important; 
  } 
  -->
  </style>
</head>

<!--~-|**|PrettyHtmlEnd|**|-~-->
</html>
<!-- end group email -->


------=_NextPart_001_007A_01CF503B.3B1C59C0--

------=_NextPart_000_0079_01CF503B.3B1C59C0
Content-Type: image/jpeg;
	name="image001.jpg"
Content-Transfer-Encoding: base64
Content-ID: <[email protected]>

/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAoHBwkHBgoJCAkLCwoMDxkQDw4ODx4WFxIZJCAmJSMg
IyIoLTkwKCo2KyIjMkQyNjs9QEBAJjBGS0U+Sjk/QD3/wAALCAAPAIkBAREA/8QAHwAAAQUBAQEB
AQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1Fh
ByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZ
WmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXG
x8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/9oACAEBAAA/APZqKKKKKKKKKKKKKKKK
KKKKKKKKKKKKKKKKKKK//9k=

------=_NextPart_000_0079_01CF503B.3B1C59C0
Content-Type: image/jpeg;
	name="image002.jpg"
Content-Transfer-Encoding: base64
Content-ID: <[email protected]>

/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAoHBwkHBgoJCAkLCwoMDxkQDw4ODx4WFxIZJCAmJSMg
IyIoLTkwKCo2KyIjMkQyNjs9QEBAJjBGS0U+Sjk/QD3/wAALCAABAAEBAREA/8QAHwAAAQUBAQEB
AQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1Fh
ByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZ
WmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXG
x8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/9oACAEBAAA/APZK/9k=

------=_NextPart_000_0079_01CF503B.3B1C59C0--