13

I was recently participating in a CTF with a challenge that required contestants to find two .pdf files with the same md5 hash, and that got me thinking about how that could be a potential vulnerability in some systems (though not necessarily a large one).

But that could be easily avoided by using multiple types of hashes of, for example, a user's password. That way, if one collision was to occur, the other hash types would be able to determine that it's not the same password. Has this ever been put into practice, or is the chance of a hash collision so rare that it doesn't really matter, and it's not worth the extra computing power?

Improve this question
11
  • 1
    Outside things like certificates and file downloads, I haven’t seen people use multi hash at all. But I would say that I. General the password hash algorithms already have such a low change for a collision as to not be relevant. But only if using password suitable hash algorithm.
    – LvB
    Sep 21 at 2:49
  • 1
    It's not uncommon for some sites to post multiple hashes of the same file. For example, Dell does this. If you go, for instance, to dell.com/support/home/en-uk/drivers/… you'll see the that MD5, SHA1, and SHA256 hashes of the driver file available for download from this page are posted here.
    – mti2935
    Sep 21 at 9:51
  • 6
    MD5 is now very broken. People can do tricks like generating a PDFs which contains an image of its own hash, for example.
    – pjc50
    Sep 21 at 10:40
  • 6
    @mti2935 I suspect that's more for user convenience, so they can verify the file with whichever hash program they happen to have.
    – Barmar
    Sep 21 at 13:51
  • 3
    As a non-crypto answer, taking multiple hashes is the basis of a Bloom Filter.
    – Cort Ammon
    Sep 21 at 20:54

4 Answers 4

Reset to default
30

Instead of using two 128 bits hashes (like md5), it is far more secure to use a single 256 bits hash. In fact, it’s more secure to use SHA-256 (256 bits long) than a combination of md5 and SHA-1 (totaling 288 bits). This would hold even in a world where no flaws were found in md5 and SHA-1. So, security experts usually use a single long hash, like SHA-256 or SHA-3.

Using multiples hashes is usually done for convenience, retro-compatibility, while transitioning between schemes, etc. But not for security reasons.

Improve this answer
0
10

The title and the body of the question ask different things. In the body it is asked if this ever has been put into practice and the answer is a clear yes - I know systems which do this. In the title instead it is asked if this is common practice and the answer is no - most systems use only a single hash algorithm for the same data.

Improve this answer
4

It's becoming increasingly common in digital forensics tools for pretty much the exact reason you mention - collisions are a known issue, and it's trivial to create two files with the same MD5 hash.

Most tools still need to generate MD5s for compatibility with other systems, but will often also create SHA-1 or SHA-256 hashes as well (plus potentially other fuzzy hashes). And while those algorithms certainly aren't immune to collisions, I don't think that anyone has ever created a file that collides in both MD5 and SHA-1/256 at the same time (although I'm happy to be corrected).

Improve this answer
2
  • 6
    I doubt there's ever been a collision of just SHA-256 between any two files among all files that have ever been hashed, let alone a simultaneous collision of SHA-256 and other hashes.
    – Vaelus
    Sep 21 at 13:47
  • 4
    @Vaelus that was the thinking for MD5 before flaws in MD5 were found. While SHA-256 and up have proven resistant until now, we don't know if someone could not find a collision. While they are statistically extremely unlikely, collisions are most definitely a mathematical possibility (since we're mapping an infinite space into a finite one), so there ARE necessarily collisions. The fact that we haven't found any yet does not mean one will not find a way to craft specific messages that hash to the same value.
    – jcaron
    Sep 22 at 11:26
-1

All the answers are good from the point of view of security for secrets that you need to prove to possess, such as passwords or passphrases.

If hashes are calculated to generate a fingerprint of documents, you can use only one strong hash algorithm. This is the case of digital signature, where someone can generate a readable collision of the document with a weak hash algorithm.

However, using more than one hash algorithm is a good practice in the Digital Forensics acquisition (chain of custody). For example, if you have to acquire a (typically large) digital memory, you have to prove that what you acquired has not been modified after some time.

The strength of the algorithm is not so relevant if you use more than one algorithm, for example MD5 and SHA1, because a possible collision is not a threat, and it does not exist in practice. What you have to prove is that the digital memory and the copy you acquired are the same. So in theory a collision can exist if you use only one algorithm, but it cannot exist with two algorithms.

Improve this answer
1
  • -1 and no comment. Please justify this vote...
    – robob
    Oct 3 at 6:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .