7

Is it possible to find 128 bits $B$ such that $md5(B) = B$?

md5 has collisions that can be computed in acceptable time, but I did not find any papers on fixed points in md5.

As pointed out in this question from 2014, there is a 63.2% probability for a totally random hash function to have a fixed point. Since some time has passed, I would be interested in newer research into the topic of fixed points, even if the analysed algorithm is not md5 itself.

Le 'nton
  • 173
  • 6

1 Answers1

9

It is not known a practical method to find a 128-bit $B$ such that $\operatorname{MD5}(B)=B$. Argument: that's essentially a first-preimage attack against a variant of MD5 defined as $H(B)=\operatorname{MD5}(B)\oplus B$ restricted to $\{0,1\}^{128}$ input space, for the all-zero result; and MD5, as well as (conjecturally) that hash variant, is still strong as far as preimage attacks go.

Moreover, if we model MD5 as a random function (a natural model), the probability that there is a solution is $1-(1-2^{-128})^{(2^{128})}\ \approx\ 1-1/e\ \approx\ 63.2\%$. That leaves us far from sure that there exists a solution: odds are about 12/7.

fgrieu
  • 140,762
  • 12
  • 307
  • 587