8

I read somewhere MD5 is broken in terms of collision, but I am wondering if it is broken in terms of pre-image resistance?

Given a hash of Md5, is it possible to find the original message of it? If so, what would be the complexity and time to crack it?

kelalaka
  • 48,443
  • 11
  • 116
  • 196
Syed Rahman
  • 101
  • 1
  • 2
  • 1
    Note that the pre-image resistance has little to do with password hashing. Brute force, dictionary attacks and rainbow tables are all possible against any hash if the input domain is small enough. Hence the reason for key strengthening functions such as PBKDF2, bcrypt and scrypt. – Maarten Bodewes Nov 28 '16 at 01:25
  • Also note that a pre-image attack is not about finding the original message, it is only about finding a message with the same hash as the original one. The first message you find that fits the hash is unlikely to be the original message unless the message domain is smaller that that of the hash. – Dreamer Jul 12 '17 at 08:36

1 Answers1

12

The only published faster-than-brute-force preimage attack I can find is this one from 2009 by Yu Sasaki and Kazumaro Aoki.

From their abstract:

This attack, with a complexity of $2^{116.9}$, generates a pseudo-preimage of MD5 and, with a complexity of $2^{123.4}$, generates a preimage of MD5. The memory complexity of the attack is $2^{45}\times 11$ words.

In short, this is not practical at all.

kodlu
  • 22,423
  • 2
  • 27
  • 57
  • 6
    any updates? where can I go to look for a reputable, up-to-date security status of hashes and their attacks? – Jason S Dec 08 '17 at 17:40