International Journal of Applied Cryptography · 2012 · 39 citations · 17 references
ComputingComputer ScienceCybersecurityComputer SecurityCryptographySecurity ArchitectureCertificate ManagementCollision DetectionCryptographic HashingCryptographic Protocol DesignElliptic Curve CryptographyInformation-theoretic CryptographyCertificate Path BuildingCertification PolicyChosen-prefix Collision AttacksChosen-prefix CollisionsCompressionHash Function AttacksHash-based CryptographyX.509 Certificates
We present a novel, automated way to find differential paths for MD5. Its main application is in the construction of chosen-prefix collisions. We have shown how, at an approximate expected cost of 239 calls to the MD5 compression function, for any two chosen message prefixes P and P′, suffixes S and S′ can be constructed such that the concatenated values P║S and P′║S′ collide under MD5. The practical attack potential of this construction of chosenprefix collisions is of greater concern than the MD5-collisions that were published before. This is illustrated by a pair of MD5-based X.509 certificates one of which was signed by a commercial Certification Authority (CA) as a legitimate website certificate, while the other one is a certificate for a rogue CA that is entirely under our control (cf. http://www.win.tue.nl/hashclash/rogue-ca/). Other examples, such as MD5-colliding executables, are presented as well. More details can be found on http://www.win.tue.nl/hashclash/ChosenPrefixCollisions/.
17
Handbook of applied cryptography
Choice Reviews Online · 1997 · 10.5K citations · Full text
The MD5 Message-Digest Algorithm
Rivest · Medical Entomology and Zoology · 1992 · 2.9K citations
Collisions for Hash Functions MD4, MD5, HAVAL-128 and RIPEMD
Xiaoyun Wang, Dengguo Feng, Xuejia Lai et al. · IACR Cryptology ePrint Archive · 2004 · 458 citations