1. How to Break MD5 and Other Hash Functions
Xiaoyun Wang(王小雲) and Hongbo Yu(於紅波)
Cryptography & Information Security
Shandong University China
Advances in Cryptology - EUROCRYPT 2005, 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Aarhus, Denmark, May 22-26, 2005, Proceedings.
Presented by: Henrry, C.Y. Chiang (江政祐)
2018/11/15
OPLAB, Dep. of Information Management, NTU

2. OPLAB, Dep. of Information Management, NTU
EUROCRYPT (1/1)
Eurocrypt (or EUROCRYPT) is an important conference for cryptography research.
The full name of the conference is currently the Annual International Conference on the Theory and Applications of Cryptographic Techniques, but this has not always been its name.
Eurocrypt is held annually in the spring in various locations throughout Europe.
The first workshop in the series of conferences that became known as Eurocrypt was held in 1982.
In 1984, the name "Eurocrypt" was first used. Generally, there have been published proceedings including all papers at the conference every year.
2018/11/15
OPLAB, Dep. of Information Management, NTU

3. OPLAB, Dep. of Information Management, NTU
About The Author (1/2)
Xiaoyun Wang (Simplified Chinese: 王小云; Traditional Chinese: 王小雲) (born 1966) is a researcher and professor in the Department of Mathematics and System Science, Shandong University, Shandong, China.
2018/11/15
OPLAB, Dep. of Information Management, NTU

4. OPLAB, Dep. of Information Management, NTU
About The Author (2/2)
At the rump session of CRYPTO 2004, she and co-authors demonstrated collision attacks against MD5, SHA-0 and other related hash functions. They received a standing ovation for their work.
In February 2005 it was reported that Wang and co-authors had found a method to find collisions in the SHA-1 hash function, which is used in many of today's mainstream security products.
She gained bachelors (1987), masters (1990) and doctorate (1993) degrees at Shandong University, and subsequently lectured in the mathematics department from Wang was appointed assistant professor in 1995, and full professor in 2001.
2018/11/15
OPLAB, Dep. of Information Management, NTU

5. OPLAB, Dep. of Information Management, NTU
OUTLINE
Introduction
Description of MD5
Differential Attack for Hash Functions
Differential Attack on MD5
Summary
2018/11/15
OPLAB, Dep. of Information Management, NTU

6. OPLAB, Dep. of Information Management, NTU
OUTLINE
Introduction
Description of MD5
Differential Attack for Hash Functions
Differential Attack on MD5
Summary
2018/11/15
OPLAB, Dep. of Information Management, NTU

7. OPLAB, Dep. of Information Management, NTU
1. Introduction (1/6)
People know that digital signatures are very important in information security.
The security of digital signatures depends on the cryptographic strength of the underlying hash functions.
Hash functions also have many other applications such as data integrity, group signature, e-cash and many other cryptographic protocols.
Nowadays, there are two widely used hash functions – MD5 and SHA-1.
2018/11/15
OPLAB, Dep. of Information Management, NTU

8. OPLAB, Dep. of Information Management, NTU
1. Introduction (2/6)
MD5 is one of the most widely used cryptographic hash functions nowadays.
It was designed in 1992 as an improvement of MD4.
In this paper we present a new powerful attack on MD5 which allows us to find collisions efficiently.
We used this attack to find collision of MD5 in about 15 minutes up to an hour computation time.
2018/11/15
OPLAB, Dep. of Information Management, NTU

9. OPLAB, Dep. of Information Management, NTU
1. Introduction (3/6)
The attack is a differential attack, which unlike most differential attack, does not use the exclusive-or as a measure of difference, but instead uses modular integer subtraction as the measure.
An application of this attack to MD4 can find collision in less than a fraction of a second.
This attack is also applicable to other hash functions, such as RIPEMD and HAVAL.
2018/11/15
OPLAB, Dep. of Information Management, NTU

10. OPLAB, Dep. of Information Management, NTU
1. Introduction (4/6)
In this paper, we want to find a pair (M0, M1) and (M0’, M1’) such that
We show that such collisions of MD5 can be found efficiently, where finding the first blocks (M0, M0’) takes about MD5 operations, and finding the second blocks (M1, M1’) takes about MD5 operations.
2018/11/15
OPLAB, Dep. of Information Management, NTU

11. OPLAB, Dep. of Information Management, NTU
1. Introduction (5/6)
2018/11/15
OPLAB, Dep. of Information Management, NTU

12. OPLAB, Dep. of Information Management, NTU
1. Introduction (6/6)
Birthday Attack
( MD5 operations)
2018/11/15
OPLAB, Dep. of Information Management, NTU

13. OPLAB, Dep. of Information Management, NTU
OUTLINE
Introduction
Description of MD5
Differential Attack for Hash Functions
Differential Attack on MD5
Summary
2018/11/15
OPLAB, Dep. of Information Management, NTU

14. OPLAB, Dep. of Information Management, NTU
2. Description of MD5 (1/5)
Generally a hash function is iterated by a compression function X = f( Z ) which compress l-bit message block Z to s-bit hash value X where l > s.
For MD5, l = 512, and s = 128.
For a padded message M with multiples of l-bit length, the iterating process is as follows:
2018/11/15
OPLAB, Dep. of Information Management, NTU

15. OPLAB, Dep. of Information Management, NTU
2. Description of MD5 (2/5)
In the above iterating process, we omit the padding method because it has no influence on our attack.
2018/11/15
OPLAB, Dep. of Information Management, NTU

16. OPLAB, Dep. of Information Management, NTU
2. Description of MD5 (3/5)
2018/11/15
OPLAB, Dep. of Information Management, NTU

17. OPLAB, Dep. of Information Management, NTU
2. Description of MD5 (4/5)
2018/11/15
OPLAB, Dep. of Information Management, NTU

18. OPLAB, Dep. of Information Management, NTU
2. Description of MD5 (5/5)
2018/11/15
OPLAB, Dep. of Information Management, NTU

19. OPLAB, Dep. of Information Management, NTU
OUTLINE
Introduction
Description of MD5
Differential Attack for Hash Functions
Differential Attack on MD5
Summary
2018/11/15
OPLAB, Dep. of Information Management, NTU

20. OPLAB, Dep. of Information Management, NTU
OUTLINE
Introduction
Description of MD5
Differential Attack for Hash Functions
3.1 The Modular Differential and the XOR Differential
3.2 Differential Attacks on Hash Functions
3.3 Optimized Collision Differentials for Hash Functions
4. Differential Attack on MD5
5. Summary
2018/11/15
OPLAB, Dep. of Information Management, NTU

21. OPLAB, Dep. of Information Management, NTU
3. Differential Attack for Hash Functions 3.1 The Modular Differential and the XOR Differential (1/7)
The most important analysis method for hash functions is differential attack which is also one of most important methods for analyzing block ciphers.
In general, the differential attack especially in block ciphers is a kind of XOR differential attack which uses exclusive-or as the difference.
Differential cryptanalysis is a method which analyzes the effect of particular differences in plain text pairs on the differences of the resultant cipher text pairs.
2018/11/15
OPLAB, Dep. of Information Management, NTU

22. OPLAB, Dep. of Information Management, NTU
3. Differential Attack for Hash Functions 3.1 The Modular Differential and the XOR Differential (2/7)
The differential definition in this paper is a kind of precise differential which uses the difference in term of integer modular subtraction.
We also use integer modular subtraction and the differences in term of XOR.
The combination of both kinds of differences give us more information than each of them keep by itself.
2018/11/15
OPLAB, Dep. of Information Management, NTU

23. OPLAB, Dep. of Information Management, NTU
3. Differential Attack for Hash Functions 3.1 The Modular Differential and the XOR Differential (3/7)
For example, when the modular integer subtraction difference is for some value X, the XOR difference can have many possibilities, which are
1. One-bit difference in bit 7, i.e., 0x In this case which means that bit 7 in X’ is 1 and bit 7 in X is 0.
X’ =
X =
2. Two-bit difference, in which a different carry is transferred from bit 7 to bit 8, i.e., 0x000000C0.
X’ =
X =
2018/11/15
OPLAB, Dep. of Information Management, NTU

24. OPLAB, Dep. of Information Management, NTU
3. Differential Attack for Hash Functions 3.1 The Modular Differential and the XOR Differential (4/7)
3. Three-bit difference, in which a different carry is transferred from bit 7 to bit 8 and then to bit 9, i.e., 0x000001C0.
X’ =
X =
4. Similarly, there can be more carries to further bits, and the binary form of X’ is 1000…, and of X is 0111….
5. In case the former difference is negative, the XOR differences still look the same, but the values of X and X’ are exchanged (i.e., X is of the form 1000…, and X’ of the form 0111… ).
2018/11/15
OPLAB, Dep. of Information Management, NTU

25. OPLAB, Dep. of Information Management, NTU
3. Differential Attack for Hash Functions 3.1 The Modular Differential and the XOR Differential (5/7)
2018/11/15
OPLAB, Dep. of Information Management, NTU

26. OPLAB, Dep. of Information Management, NTU
3. Differential Attack for Hash Functions 3.1 The Modular Differential and the XOR Differential (6/7)
2018/11/15
OPLAB, Dep. of Information Management, NTU

27. OPLAB, Dep. of Information Management, NTU
3. Differential Attack for Hash Functions 3.1 The Modular Differential and the XOR Differential (7/7)
Compared with earlier modular differential attacks, our attack has the following advantages:
Our attack is to find collisions with two iterations, i. e., each message in the collision includes two message blocks (1024-bit).
Our attack is a precise differential attack in which the characteristics are more restrictive than used, and that they gives values of bits in addition to the differences.
Our attack gives a set of sufficient conditions which ensure the differential to occur.
Our attack use a message modification technique to greatly improve the collision probability.
2018/11/15
OPLAB, Dep. of Information Management, NTU

28. OPLAB, Dep. of Information Management, NTU
3. Differential Attack for Hash Functions 3.2 Differential Attacks on Hash Functions (1/2)
The difference for two parameters X and X’ is defined as
For any two messages M and M’ with l-bit multiples,
a full differential for a hash function is defined as follows:
where is the initial value difference which equals to zero is the output difference for the two messages is the output difference for the i-th iteration, and also is the initial difference for the next iteration.
2018/11/15
OPLAB, Dep. of Information Management, NTU

29. OPLAB, Dep. of Information Management, NTU
3. Differential Attack for Hash Functions 3.2 Differential Attacks on Hash Functions (2/2) j
2018/11/15
OPLAB, Dep. of Information Management, NTU

30. OPLAB, Dep. of Information Management, NTU
3. Differential Attack for Hash Functions 3.3 Optimized Collision Differentials for Hash Functions (1/2)
Our attack uses a message modification technique to improve the collision probability.
According to the modification technique, we can get a rough method to search for optimized differentials of a hash function.
2018/11/15
OPLAB, Dep. of Information Management, NTU

31. OPLAB, Dep. of Information Management, NTU
3. Differential Attack for Hash Functions 3.3 Optimized Collision Differentials for Hash Functions (2/2)
There are two kinds of message modifications:
2018/11/15
OPLAB, Dep. of Information Management, NTU

32. OPLAB, Dep. of Information Management, NTU
OUTLINE
Introduction
Description of MD5
Differential Attack for Hash Functions
Differential Attack on MD5
Summary
2018/11/15
OPLAB, Dep. of Information Management, NTU

33. OPLAB, Dep. of Information Management, NTU
OUTLINE
Introduction
Description of MD5
Differential Attack for Hash Functions
Differential Attack on MD5
4.1 Notation
4.2 Collision Differentials for MD5
4.3 Sufficient Conditions for the Characteristics to Hold
4.4 Message Modification
4.5 The Differential Attack on MD5
5. Summary
2018/11/15
OPLAB, Dep. of Information Management, NTU

34. 4. Differential Attack on MD5 4.1 Notation (1/1)
2018/11/15
OPLAB, Dep. of Information Management, NTU

35. OPLAB, Dep. of Information Management, NTU
4. Differential Attack on MD5 4.2 Collision Differentials for MD5 (1/5)
Our attack can find many real collisions which are composed of two 1024-bit messages and with the original initial value of MD5:
We select a collision differential with two iterations as follows:
2018/11/15
OPLAB, Dep. of Information Management, NTU

36. OPLAB, Dep. of Information Management, NTU
4. Differential Attack on MD5 4.2 Collision Differentials for MD5 (2/5)
2018/11/15
OPLAB, Dep. of Information Management, NTU

37. 4. Differential Attack on MD5 4
4. Differential Attack on MD5 4.2 Collision Differentials for MD5 (3/5)
Why does the author choose this collision differential?
2018/11/15
OPLAB, Dep. of Information Management, NTU

38. OPLAB, Dep. of Information Management, NTU
4. Differential Attack on MD5 4.2 Collision Differentials for MD5 (4/5)
Step Chaining Variable for M0 Message Word for M0 Shift Rotation Message Word Difference Chaining Variable Difference Chaining Variable for M0’
Especially, the empty items both in sixth and fifth columns denotes zero differences, and steps those aren’t listed in the table have zero differences both for message words and chaining variables.
2018/11/15
OPLAB, Dep. of Information Management, NTU

39. OPLAB, Dep. of Information Management, NTU
4. Differential Attack on MD5 4.2 Collision Differentials for MD5 (5/5)
2018/11/15
OPLAB, Dep. of Information Management, NTU

40. OPLAB, Dep. of Information Management, NTU
4. Differential Attack on MD5 4.3 Sufficient Conditions for the Characteristics to Hold (1/9)
How to derive a set of sufficient conditions that guarantee the differential characteristic in Step 8 of MD5 (Table 3) to hold. Other conditions can be derived similarly.
The differential characteristic in Step 8 of MD5 is:
Each chaining variable satisfies one of the following equations.
2018/11/15
OPLAB, Dep. of Information Management, NTU

41. OPLAB, Dep. of Information Management, NTU
4. Differential Attack on MD5 4.3 Sufficient Conditions for the Characteristics to Hold (2/9)
2018/11/15
OPLAB, Dep. of Information Management, NTU

42. OPLAB, Dep. of Information Management, NTU
4. Differential Attack on MD5 4.3 Sufficient Conditions for the Characteristics to Hold (3/9)
According to the operations in the 8-th step, we have
2018/11/15
OPLAB, Dep. of Information Management, NTU

43. OPLAB, Dep. of Information Management, NTU
4. Differential Attack on MD5 4.3 Sufficient Conditions for the Characteristics to Hold (4/9)
We get a set of sufficient conditions that ensure the differential characteristic holds:
2018/11/15
OPLAB, Dep. of Information Management, NTU

44. OPLAB, Dep. of Information Management, NTU
4. Differential Attack on MD5 4.3 Sufficient Conditions for the Characteristics to Hold (5/9)
2018/11/15
OPLAB, Dep. of Information Management, NTU

45. OPLAB, Dep. of Information Management, NTU
4. Differential Attack on MD5 4.3 Sufficient Conditions for the Characteristics to Hold (6/9)
2018/11/15
OPLAB, Dep. of Information Management, NTU

46. OPLAB, Dep. of Information Management, NTU
4. Differential Attack on MD5 4.3 Sufficient Conditions for the Characteristics to Hold (7/9)
2018/11/15
OPLAB, Dep. of Information Management, NTU

47. OPLAB, Dep. of Information Management, NTU
4. Differential Attack on MD5 4.3 Sufficient Conditions for the Characteristics to Hold (8/9)
By the similar method, we can derive a set of sufficient conditions (Table 4 and Table 6) which guarantee all the differential characteristics in the collision differential to hold
2018/11/15
OPLAB, Dep. of Information Management, NTU

48. OPLAB, Dep. of Information Management, NTU
4. Differential Attack on MD5 4.3 Sufficient Conditions for the Characteristics to Hold (9/9)
2018/11/15
OPLAB, Dep. of Information Management, NTU

49. 4. Differential Attack on MD5 4.4 Message Modification (1/9)
Single-Message Modification
In order to make the attack efficient, it is very attractive to improve over the probabilistic method, by fixing some of the message words to a prior fulfilling some of the conditions
We observe that it is very easy to generate messages that fulfill all the conditions of the first 16 steps of MD5. We call it single-message modification.
For each message block M0 (or similarly M1) and intermediate values (H0, or for the second block H1 and H1’), we apply the following procedures to modify M0 (or M1), so that all the conditions of round 1 (the first 16 steps) in Table 4 and Table 6 hold.
2018/11/15
OPLAB, Dep. of Information Management, NTU

50. 4. Differential Attack on MD5 4.4 Message Modification (2/9)
Single-Message Modification (cont.)
It is easy to modify M0 such that the conditions of round 1 in Table 4 hold with probability 1.
For example, to ensure that 3 conditions for c1 in Table 4 hold, we modify m2 as follows:
2018/11/15
OPLAB, Dep. of Information Management, NTU

51. 4. Differential Attack on MD5 4.4 Message Modification (3/9)
2018/11/15
OPLAB, Dep. of Information Management, NTU

52. 4. Differential Attack on MD5 4.4 Message Modification (4/9)
2018/11/15
OPLAB, Dep. of Information Management, NTU

53. 4. Differential Attack on MD5 4.4 Message Modification (5/9)
Single-Message Modification (cont.)
By modifying each message word of message M0, all the conditions in round 1 of Table 4 hold. The first iterations differential hold with probability
The same modification is applied to M1. After modification, the second iteration differential hold with probability
2018/11/15
OPLAB, Dep. of Information Management, NTU

54. 4. Differential Attack on MD5 4.4 Message Modification (6/9)
Multi-Message Modification
It is even possible to fulfill a part of the conditions of the first 32 steps by an multi-message modification.
For example, a5,32 = 1, we correct it into a5,32 = 0 by modifying m1, m2, m3, m4, m5 such that the modification generates a partial collision from 2-6 steps, and remains that all the conditions in round 1 hold.
2018/11/15
OPLAB, Dep. of Information Management, NTU

55. 4. Differential Attack on MD5 4.4 Message Modification (7/9)
Multi-Message Modification (cont.)
2018/11/15
OPLAB, Dep. of Information Management, NTU

56. 4. Differential Attack on MD5 4.4 Message Modification (8/9)
2018/11/15
OPLAB, Dep. of Information Management, NTU

57. 4. Differential Attack on MD5 4.4 Message Modification (9/9)
Multi-Message Modification (cont.)
By our modification, 37 conditions in round 2-4 are undetermined in the table 4, and 30 conditions in round 2-4 are undetermined in the table 6.
So, the 1-st iteration differential holds with probability , and the second iteration differential holds with probability
2018/11/15
OPLAB, Dep. of Information Management, NTU

58. 4. Differential Attack on MD5 4.5 The Differential Attack on MD5 (1/5)
2018/11/15
OPLAB, Dep. of Information Management, NTU

59. 4. Differential Attack on MD5 4.5 The Differential Attack on MD5 (2/5)
2018/11/15
OPLAB, Dep. of Information Management, NTU

60. 4. Differential Attack on MD5 4.5 The Differential Attack on MD5 (3/5)
The complexity of finding (M0, M0’) doesn’t exceed the time of running MD5 operations.
To select another message M0 is only to change the last two words from the previous selected message M0.
So, finding (M0, M0’) only needs about one-time single-message modification for the first 14 words. This time can be neglected.
2018/11/15
OPLAB, Dep. of Information Management, NTU

61. 4. Differential Attack on MD5 4.5 The Differential Attack on MD5 (4/5)
For each selected message M0, it is only needs two-time single-message modifications for the last two words and 7-time multi-message modifications for correcting 7 conditions in the second round, and each multi-message modification only needs about a few step operations.
According to the probability of the first iteration differential, it is easy to know that the complexity of finding (M0, M0’) is not exceeds MD5 operations.
Similarly, we can show that the complexity of finding (M1, M1’) is not exceeds MD5 operations.
2018/11/15
OPLAB, Dep. of Information Management, NTU

62. 4. Differential Attack on MD5 4.5 The Differential Attack on MD5 (5/5)
2018/11/15
OPLAB, Dep. of Information Management, NTU

63. OPLAB, Dep. of Information Management, NTU
OUTLINE
Introduction
Description of MD5
Differential Attack for Hash Functions
Differential Attack on MD5
Summary
2018/11/15
OPLAB, Dep. of Information Management, NTU

64. OPLAB, Dep. of Information Management, NTU
5. Summary(1/3)
This paper described a powerful attack against hash functions, and in particular showed that finding a collision of MD5 is easily feasible.
This attack is also able to break efficiently other hash functions, such as HAVAL-128, MD4, RIPEMD, and SHA-0.
2018/11/15
OPLAB, Dep. of Information Management, NTU

65. OPLAB, Dep. of Information Management, NTU
5. Summary(2/3) The analysis results for these hash functions are as follows
The time complexity for finding a collision for MD4 is about MD4 operations without the multi-message modification, and is about MD4 operations with the multi-message modification.
The time complexity for finding a collision for HAVAL-128 is about HAVAL-128 operations without the multi-message modification, and is HAVAL-128 operations with the multi-message modification.
2018/11/15
OPLAB, Dep. of Information Management, NTU

66. OPLAB, Dep. of Information Management, NTU
5. Summary(3/3) The analysis results for these hash functions are as follows
3. The time complexity for finding a collision for RIPEMD is about RIPEMD operations without the multi-message modification, and is RIPEMD operations with the multi-message modification.
4. The time complexity for finding a collision for SHA-0 is about SHA-0 operations without the multi-message modification, and is SHA-0 operations with the multi-message modification.
2018/11/15
OPLAB, Dep. of Information Management, NTU

67. OPLAB, Dep. of Information Management, NTU
結束了
Thanks A Lot
政祐のPresentation
2018/11/15
OPLAB, Dep. of Information Management, NTU