Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If I have a salt of 16bytes and 16bytes of data, how fast can one find another 16bytes of data so that MD5(salt + data) == MD5(salt + other data)?

I don't expect an answer accurate to the nanosecond, just an estimation like "a few seconds", "a few hours", "a few civilizations".

share|improve this question

1 Answer 1

up vote 5 down vote accepted

What you want is not a collision but a second preimage.

A collision is: find two distinct messages m and m' which hash to the same value.

A second preimage is: given a message m, find a distinct message m' such that both messages hash to the same value.

Second preimages are harder because the attacker does not get to choose both messages at will. MD5 is very broken against collisions (collisions can be generated in less than a second) but not against second preimages. For that, the best known attack is a generic preimage attack which is theoretical only, since it has cost 2123.4, i.e. much higher that what can be done in practice.

So the raw answer to your specific question is: it cannot be done (with existing technology and known attacks on MD5).

(I am here talking only about finding a second preimage on MD5, not about the security of using MD5(salt + data) in any specific context, whether 'salt' and 'data' are known or not. I suspect that anybody who uses MD5(salt + data) actually wants either a password hashing function, or HMAC.)

share|improve this answer
    
So MD5(salt + password) is still quite secure. Thank you for the information. –  Serge Profafilecebook May 9 at 7:38
    
No, we cannot say in general that "MD5(salt + password)" is "secure". As a way to store password hashes for ulterior verification, it is terrible and weak. What I say is that, given one password, finding another one which yields the same hash value will be hard -- but in most cases of password hashing, the attacker just want to find the actual user's password, not another one. –  Thomas Pornin May 9 at 10:11
    
How would you validate a password without a hash? –  Serge Profafilecebook May 9 at 13:47
    
I don't reject the concept, but the method. Password hashing has been the subject of a lot of theory and practice, from which it appears that "MD5(salt+data)", while better than "MD5(data)", is still weak. Better ways are known and used; read this answer for an introduction. –  Thomas Pornin May 10 at 11:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.