1

Since PHP has loose type comparison, we have:

php -r 'var_dump("1234e03"=="1234000");'
bool(true)

And since MD5 hashs are often reprensented as hexa string like 713f44b3d2c680df02eb5a0bde86fcd7

Are there two already known values that make a MD5 collison for PHP loose type comparison like md5($value1) == md5($value2) ?

With the snippet time crunch 1 6|pv|php -r '$x=fopen("php://stdin","r");while ($l=trim(fgets($x))) {if (is_numeric(md5($l))) { echo "$l\t".md5($l)."\n"; exit; } }' I found that ecrbx yields 0310763137713908293306e502423361 which is a number in scientific notation. So I guess such collisions could be easier to do than plain simple collisions, but I don't know any example.

The same question would apply for other hash functions, like SHA1, SHA256, etc but would probably be harder to answer

1
  • 1
    Yes. This is a known issue and have a known solution: use === instead.
    – ThoriumBR
    May 13 at 15:27

1 Answer 1

2

These are often known as "magic hashes", and have been found for lots of different hashing algorithms. You can find a list of them here.

The easiest way to find them to to look for a hash output that starts with 0e, and the rest of the hash is all numbers (because zero times 10 to the power of anything is zero).

For example, for MD5 240610708 hashes to 0e462097431906509019562988736854 and and QLTHNDT hashes to 0e405967825401955372549139051580:

$ php -r 'var_dump(md5("240610708") == md5("QLTHNDT"));'
bool(true)
1
  • 1
    Neat, thanks, I didn't know that "magic hashes" name (and didn't think of the 0e idea :) )
    – Xenos
    May 13 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.