Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -2 down vote favorite
1

Possible Duplicate:
Generating random numbers with repeated hashing, but without using a standard hash function

I need a new mechanism to create Random Number Generate(RNG). In which repetition should be very rare too. RN would be use as hash.
What I planed to changes the MD5 or SHA because both are good hash functions and collision is very rare in real scenario. Also both produce quit a different MD5 values even only a single bit change in input.
To create a variants of MD5, I made following changes :
1. MD5 uses a non-linear sin(i)* pow(2,32) ----> i plane to use cos(i)*pow(2,32)
2. Instead original values of A, B, C, D that are four initial seeds( or states), that changes additively during the processing of input text.----> I am planing to start with some different then given in MD5's RFC.
3. Also I would change the code functions. F,G,H,I (in MD5's RFC) with any other used in SHA r other.

I just want to know, What would be the effect on properties of MD5(of being a good hash funtion).
I want to use variant as a good hash function. I am not using Md5's variant for authentication mechanism.

Although, I have created four variants using above ideas and checked this with time inputs of 10 to 20 minutes and its working fine. Am i doing correct ?

share|improve this question
Hashes are not random. – driis Sep 15 '12 at 13:54
What is the problem with the output of MD5? – CodeCaster Oct 8 '12 at 23:25
You asked this question before, and we closed it as a duplicate. Take our advice - use a proper random number generator and DO NOT roll your own crypto. – Polynomial Oct 9 '12 at 12:41

migrated from stackoverflow.com Oct 9 '12 at 12:32

marked as duplicate by Polynomial, AviD♦ Oct 9 '12 at 12:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers

up vote 1 down vote

If you need a unique hash function, the most common thing to do is to use your own unique salt with a standard algorithm - that way you don't risk accidentally making the hash weaker by messing around with its internal maths.

You can include the salt by appending it onto your plaintext:

hashSHA256('thing to hash' + 'my secret salt UYT23gje6t21313d72')
share|improve this answer
So you are suggesting me put md5 output as salt in next round .... – Grijesh Chauhan Sep 15 '12 at 17:59
No! I'm suggesting you choose a (constant) salt, and use it to make your "new" hash function, instead of trying to modify one internally. – James Sep 15 '12 at 18:03
up vote 2 down vote

Hashes are not random number generators.

You are inventing your own crypto. Do not invent your own crypto.

Worst, say you modify MD5. Now you have n = MD5'(x). You still need a random x in order to get your "random" number. Where, exactly, will this input come from? You haven't solved the problem; you've simply moved it somewhere else.

share|improve this answer
1  
@Stepen Touset-Thanks for answer.But sorry, you misunderstood my question. I asked whether, the changes I made would effect the properties of original MD5 or not? And I thought it will not!. I have already verified it for 10 to 20 mins. on random input but I still want an opinion of others on this. MD5 is a hash function useful in authentication and data integrity. But may time it has been use for RNG.I need a hash function that is different than existing. Randomness needed to select randomly. And its well suited to the application.Plz give your OPINION how the change effect MD5 property. – Grijesh Chauhan Oct 9 '12 at 4:48
What properties do you think it will not modify? Running a hash on 20 minutes of input is not even close to proof. – Stephen Touset Oct 9 '12 at 5:59
Yes I can't trust on 20 mins output. That why I need your suggestion. Properties I required: Low-Collision, Quite different output hash values even on single input bit change...Also I can't use original one. – Grijesh Chauhan Oct 9 '12 at 6:07
@Chauhan - We are telling you that MD5 and SHA are not good solutions to generate a random number. The chances of a collision surrounding SHA and MD5 are higher then you realize. Why don't you use a solution like GUID where the proability of a unique value is nearly guaranteed. – Ramhound Oct 9 '12 at 12:39
Why can't you use the original one? And why would you use MD5, which is utterly broken at this point? – Stephen Touset Oct 9 '12 at 15:58
show 2 more comments

Not the answer you're looking for? Browse other questions tagged or ask your own question.