Re: [zooko@zooko.com: [Revctrl] colliding md5 hashes of human-meaningful documents]

From: Daniel Barkalow <barkalow@iabervon.org>
Date: Jun 14, 2005, 02:06 UTC
Message-ID: <Pine.LNX.4.21.0506132141250.30848-100000@iabervon.org>
In-Reply-To: <Pine.LNX.4.58.0506120949150.2286@ppc970.osdl.org>

On Sun, 12 Jun 2005, Linus Torvalds wrote:

> Put another way: you could use this exact example for a version of git
> that uses md5-sums instead of sha1's, but it wouldn't show anything at all 
> about a git vulnerability even so.

You couldn't use this exact example for an md5 git; git compresses the files before hashing, which means that you don't have an md5 block of arbitrary data you can replace with a different arbitrary block because it wouldn't decompress.

Of course, if zlib has a way of saying, "if bytes 256-511 match 512-767, decompress the first of the two records starting at 768, otherwise decompress the second" then the attack would work, and we should all by worried (and disturbed by zlib in general). Chances are that it would be impractical to find a pair of blocks such that they are both valid in the same part of a zlib record and both leave the compression context such that the same remaining content decompresses successfully and both have the same md5 hash, let alone getting the results in both cases to be valid C that depends on the difference between the blocks. It's possible that you could get it to work with only a moderately large number of weak collisions between very similar blocks, but it's not nearly so easy a task.

	-Daniel
*This .sig left intentionally blank*