Re: SHA1 hash safety
- From
- David Meybohm <dmeybohmlkml@bellsouth.net>
- Date
- Apr 19, 2005, 22:30 UTC
- Message-ID
- <20050419223027.GA26100@localhost>
- In-Reply-To
- <20050418074323.GA29765@hexapodia.org>
On Mon, Apr 18, 2005 at 12:43:23AM -0700, Andy Isaacson wrote:
Show 6 quoted lines
> > I'm not going to do the sums, but I would hazard a guess that it's more > likely your PC suffered a cosmic-ray-induced memory fault - EACH OF THE > FOUR TIMES YOU TESTED IT - causing it to report the same MD5, than that > you actually discovered a collision with a measly million (or even > hundred million) plaintexts.
But doesn't this require assuming the distribution of MD5 is uniform, and don't the papers finding collisions in less show it's not? So, your birthday-argument for calculating the probability wouldn't apply, because it rests on the assumption MD5 is uniform, and it isn't.
For example, say most people are married in June, get pregnant, and there are more births around March, 9 months later, than in other months. Then if you are born in March you have a higher chance of seeing a collision of your birthday with someone else's. The same is true for someone else born in March too, and this makes the chances of seeing a collision for the whole function higher.