Are there any known MD5 hash collisions of messages of different length?

Question

All the examples of MD5 hash collisions I've come across comprise two different messages (inputs) of the same length. The first and second messages have different values for a number of bits and the resulting MD5's are equal.

Does the theory of finding an MD5 hash collision (exploiting the weakness in the algorithm) prescribe that the lengths of the messages be the same? In other words, would the theory be unusable to find a collision of two messages of different lengths? Has such a collision ever been found?

Answer 1

Does the theory of finding an MD5 hash collision (exploiting the weakness in the algorithm) prescribe that the lengths of the messages be the same? In other words, would the theory be unusable to find a collision of two messages of different lengths?

MD5 includes the length of the message in the final block. This means that from an attackers point of view, for reasonable sized messages*, a difference in message length* is effectively equivalent to a distinct chosen suffix.

There have been attacks on MD5 that have allowed for distinct chosen prefixes, but afaik none that allow for distinct chosen suffixes.

* Technically you could find a collision between two messages whose size differed by 2^64 bits, but actually storing and transmitting the larger of the two messages may pose a challenge.