4

The MD5 hashing algorithm is known to be vulnerable to collisions for a number of years now, see its Wikipedia entry. Still, I see that in many places throughout the web, MD5 is used to verify download integrity, e.g., the Ubuntu images. CMake's ExternalData()C feature description even says:

Note that the hashes are used only for unique data identification and download verification. This is not security software.

It seems that an attacker could append malicious data to a download, and then append a little more to provoke a hash collision.

Why do security concerns about MD5 not impact its popularity as download verification? Why have SHA1 (or similarly safe algorithms) not become the standard?

Improve this question
2
  • 8
    Collision resistance isn't that important for fingerprints, second pre-image resistance is what you really need. For a collision attack the attacker needs to influence both the benign and the malicious file. In your attack the attacker can only modify the malicious variant and thus has to succeed at a second pre-image attack. There are no known efficient preimage attacks against MD5.
    – CodesInChaos
    Commented Aug 5, 2014 at 14:33
  • @CodesInChaos I'd love to read an answer by you expanding this idea, maybe including some read about preimage attacks to get started on the topic. Afaiu I can insert malious code into an image together with padding to make the image a collision with the hash. If yes, it that harder to do with SHA256 which everyone seems to be offering for verification these days?
    – Kalle Richter
    Commented Jul 1, 2021 at 15:18

1 Answer 1

Reset to default
2

I prefer CIC's comment-answer, but the way I have always viewed it is that collisions aren't always useful.

Maybe two text strings can have a collision and if they fit in a password input field, that's a problem.

But what are the odds of useful malicious code, that actually works, being injected into another program and generating the same checksum? Probably absurdly small.

You'd need a wonder-computer to take the legit software + malicious code, and figure out what kind of garbage data needs to be added to the file in order to create the same checksum and filesize and all of that.

This of course assumes the hash is preimage resistant. The wonder-computer being something that not only make the infeasible feasible, but also finding a collision that has both functional legit software + malicious code.

So in that regard, not really a security concern.

Improve this answer
1
  • 3
    "But what are the odds of useful malicious code, that actually works, being injected into another program and generating the same checksum? Probably absurdly small." Not much smaller than the odds of doing any change and generating the same checksum.
    – CodesInChaos
    Commented Aug 5, 2014 at 21:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .