3

The MD5 hashing algorithm is known to be vulnerable to collisions for a number of years now, see its Wikipedia entry. Still, I see that in many places throughout the web, MD5 is used to verify download integrity, e.g., the Ubuntu images. CMake's ExternalData()C feature description even says:

Note that the hashes are used only for unique data identification and download verification. This is not security software.

It seems that an attacker could append malicious data to a download, and then append a little more to provoke a hash collision.

Why do security concerns about MD5 not impact its popularity as download verification? Why have SHA1 (or similarly safe algorithms) not become the standard?

  • 7
    Collision resistance isn't that important for fingerprints, second pre-image resistance is what you really need. For a collision attack the attacker needs to influence both the benign and the malicious file. In your attack the attacker can only modify the malicious variant and thus has to succeed at a second pre-image attack. There are no known efficient preimage attacks against MD5. – CodesInChaos Aug 5 '14 at 14:33
  • 6
    @CodesInChaos This should probably be promoted to an answer. – Nico Schlömer Aug 5 '14 at 14:38
  • 1
    I agree, with a link to his great explanation of hash resistances: crypto.stackexchange.com/a/1174 – RoraΖ Aug 5 '14 at 15:36
  • 1
    Agreed. @CodesInChaos post should be an answer. – injector Aug 5 '14 at 18:31
1

I prefer CIC's comment-answer, but the way I have always viewed it is that collisions aren't always useful.

Maybe two text strings can have a collision and if they fit in a password input field, that's a problem.

But what are the odds of useful malicious code, that actually works, being injected into another program and generating the same checksum? Probably absurdly small.

You'd need a wonder-computer to take the legit software + malicious code, and figure out what kind of garbage data needs to be added to the file in order to create the same checksum and filesize and all of that.

This of course assumes the hash is preimage resistant. The wonder-computer being something that not only make the infeasible feasible, but also finding a collision that has both functional legit software + malicious code.

So in that regard, not really a security concern.

  • 3
    "But what are the odds of useful malicious code, that actually works, being injected into another program and generating the same checksum? Probably absurdly small." Not much smaller than the odds of doing any change and generating the same checksum. – CodesInChaos Aug 5 '14 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.