Groups > comp.os.linux.advocacy > #351162

Re: LOL underestimated

From	owl <owl@rooftop.invalid>
Newsgroups	comp.os.linux.advocacy
Subject	Re: LOL underestimated
Date	2016-04-21 17:12 +0000
Organization	O.W.L.
Message-ID	<fhjgoe03.afaa3@rooftop.invalid> (permalink)
References	(5 earlier) <20160420232546.4804cf6f@maxa-pc> <ghjmbnjc03.are@rooftop.invalid> <nf8tc6$f5c$1@dont-email.me> <ghjdu03.a09uh3@rooftop.invalid> <nf9t9g$6n5$1@dont-email.me>

Show all headers | View raw

Peter Köhlmann <peter-koehlmann@t-online.de> wrote:
> owl wrote:
> 
>> Peter Köhlmann <peter-koehlmann@t-online.de> wrote:
>>> owl wrote:
>>> 
>>>> Melzzzzz <mel@zzzzz.com> wrote:
>>>>> On Wed, 20 Apr 2016 21:13:16 +0000 (UTC)
>>>>> owl <owl@rooftop.invalid> wrote:
>>>>> 
>>>>>> Melzzzzz <mel@zzzzz.com> wrote:
>>>>>> > On Wed, 20 Apr 2016 17:34:37 +0000 (UTC)
>>>>>> > owl <owl@rooftop.invalid> wrote:
>>>>>> >   
>>>>>> >> 
>>>>>> >> I'm simultaneously running an attack on a particular hash over the
>>>>>> >> entire address space (those eight small windows in the vid).
>>>>>> >>   
>>>>>> > 
>>>>>> > https://eprint.iacr.org/2006/105
>>>>>> > Tunnels in Hash Functions: MD5 Collisions Within a Minute
>>>>>> 
>>>>>> Unless I'm misunderstanding things, that's just generating collision
>>>>>> pairs.  Correct me if I'm wrong, but I assume that all attacks
>>>>>> against a hash still require a dictionary of hashes (which is what
>>>>>> I'm generating).
>>>>>> 
>>>>> 
>>>>> If you find collision of particular length, you have probable
>>>>> solution...
>>>> 
>>>> Length of what?
>>>> Can you give me a layman's executive summary of how the described
>>>> approach can reveal the original input given only the known hash?
>>> 
>>> There is none. The MD5 collisions just give another set of data which
>>> will return the same MD5 hash. You don't get a peek at the original data
>>> 
>>> For that very reason linux packages protected by MD5 are still safe,
>>> because a "forged" package would not be runable in any way. There is no
>>> way to alter a program (with the intent of introducing malware) and
>>> expecting to get the original MD5 hash. All the supercomputers existing
>>> don't have enough time to compute that before crumbling to rust and sand
>> 
>> So would you say that the approach I'm taking, i.e. a lookup table, is
>> the best approach?
> 
> Maybe
> 
> It /might/ be that it is possible for data of very small size (for example 
> IP addresses) to generate collisions and compare the resulting IP. Since 
> those are restricted to a well defined format and range (in IP4 at least, 
> IP6 is already much larger) it may be possible, although I doubt that it is 
> worth the expense in time

I assume you're talking about the algorithm Melzzzzz mentioned.
I take it that given the hash, the algorithm would take a dictionary
of small strings and determine colliding values and hope that one
of them was an IP address?

I checked for the source code that's at the site Melzzzz linked.
One was Win32 and required conio.h

Another was c++ and failed to compile because it couldn't find
some boost "filesystem" file.  I installed libboost-filesystem1.55.0
and still got the error.

I'm mainly interested in how it works, not so much from a mathematical
angle as from the standpoint of the user.  IOW, what prerequisites
do you need in terms of dictionary file, etc.

Thread

LOL underestimated owl <owl@rooftop.invalid> - 2016-04-20 15:10 +0000
  Re: LOL underestimated vallor <vallor@cultnix.org> - 2016-04-20 16:55 +0000
    Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-20 17:25 +0000
      Re: LOL underestimated vallor <vallor@cultnix.org> - 2016-04-20 18:45 +0000
        Re: LOL underestimated vallor <vallor@cultnix.org> - 2016-04-20 18:47 +0000
          Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-20 21:05 +0000
            Re: LOL underestimated vallor <vallor@cultnix.org> - 2016-04-25 19:07 +0000
              Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-25 21:16 +0000
        Re: LOL underestimated Melzzzzz <mel@zzzzz.com> - 2016-04-20 20:51 +0200
  Re: LOL underestimated Melzzzzz <mel@zzzzz.com> - 2016-04-20 19:19 +0200
    Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-20 17:34 +0000
      Re: LOL underestimated Melzzzzz <mel@zzzzz.com> - 2016-04-20 20:31 +0200
        Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-20 21:13 +0000
          Re: LOL underestimated Melzzzzz <mel@zzzzz.com> - 2016-04-20 23:20 +0200
            Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-20 21:29 +0000
              Re: LOL underestimated Me Sham <osirus47@yahoo.com> - 2016-04-20 14:33 -0700
                Re: LOL underestimated Melzzzzz <mel@zzzzz.com> - 2016-04-20 23:58 +0200
                Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-20 22:04 +0000
          Re: LOL underestimated Melzzzzz <mel@zzzzz.com> - 2016-04-20 23:25 +0200
            Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-20 21:41 +0000
              Re: LOL underestimated Peter Köhlmann <peter-koehlmann@t-online.de> - 2016-04-20 23:50 +0200
                Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-20 22:06 +0000
                Re: LOL underestimated Peter Köhlmann <peter-koehlmann@t-online.de> - 2016-04-21 08:54 +0200
                Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-21 17:12 +0000
              Re: LOL underestimated Melzzzzz <mel@zzzzz.com> - 2016-04-20 23:50 +0200
                Re: LOL underestimated Peter Köhlmann <peter-koehlmann@t-online.de> - 2016-04-20 23:51 +0200
                Re: LOL underestimated Melzzzzz <mel@zzzzz.com> - 2016-04-20 23:59 +0200
                Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-20 22:10 +0000
                Re: LOL underestimated Melzzzzz <mel@zzzzz.com> - 2016-04-21 00:11 +0200
                Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-20 22:19 +0000
                Re: LOL underestimated Melzzzzz <mel@zzzzz.com> - 2016-04-21 00:57 +0200
                Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-21 00:07 +0000
      Re: LOL underestimated DFS <nospam@dfs.com> - 2016-04-20 23:17 -0400
        Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-21 03:49 +0000
          Re: LOL underestimated DFS <nospam@dfs.com> - 2016-04-21 10:27 -0400
            Re: LOL underestimated owl <owl@rooftop.invalid> - 2016-04-21 16:26 +0000

csiph-web