This is the same legal system that still uses polygraphs as “lie defectors” and known-junk DNA matching tests as fact, so this isn’t exactly shocking.
What court has admitted polygraph test results into evidence? Surely, none in the US.
The Curious Case of MD5
21–30 of 173 posts
Re: The Curious Case of MD5
#22The unsatisfying answer to this is probably that it just doesn't matter. It's not as if evidence chain of custody is assured cryptographically; it's assured by rules and regulations and an adversarial system. If you tried to submit as evidence a forged document vouchsafed with a colliding MD5 hash, you'd be putting your own freedom at risk, because the forgery will be straightforwardly detectable (the real document w…
This is more or less what I learned when I worked on forensics software, the kind that was supposed to maintain this kind of chain of custody/integrity. Like most things that touch the legal system, the presumption is that dishonesty or unsoundness in the chain of custody is fundamentally a legal problem with legal recourses, not something that can be solved with math.
I quite like the licensing trick Nintendo used on the gameboy as an example of this. [0]
Essentially, the gameboy expected a bitmap of the Nintendo logo to be present on the cartridge rom, and was shown on screen at boot. It had to match a version stored on the gameboy itself or else the game wouldn’t start.
The thinking (that I’m not sure was ever tested) was that someone producing a game that tried to trick consumers into thinking it was an official Nintendo product, would be liable for damages in a trademark lawsuit. Since the game would never start without an official Nintendo logo, the hope was to make the legal system enforce Nintendo’s licensing scheme.
Re: The Curious Case of MD5
#23Earlier quoted context omitted.
There's a GIF MD5-quine here: https://news.ycombinator.com/item?id=13823704 And a PNG version too: https://news.ycombinator.com/item?id=32956964 But no one has made an exclusively plaintext (ASCII) MD5-quine yet, and I suspect doing so may be impossible given the characteristics of collision blocks.
How is it impossible? I would think an MD5 quine exists with probability approaching 1 as the size of the document grows to infinity. Think about the reduced problem: 1. a document containing "1", whose hash begins with "1" 2. a document containing "12", whose hash begins with "12" 3. a document containing "123", whose hash begins with "123" #1 is certain to exist. #2 exists, but would take 16x as long to brute force…
as the size of the document grows to infinity.
Therein lies the problem.
Also the fact that it would need to be constrained to 7-bit ASCII only, and on top of that be "valid" in its natural language. It's a neat trick to make two documents look completely different with the same hash, but looking at the techniques which are required, they all rely on a binary file format and copious amounts of data which are effectively "hidden" --- all of which do not apply to a text file.
Re: The Curious Case of MD5
#24Earlier quoted context omitted.
This is more or less what I learned when I worked on forensics software, the kind that was supposed to maintain this kind of chain of custody/integrity. Like most things that touch the legal system, the presumption is that dishonesty or unsoundness in the chain of custody is fundamentally a legal problem with legal recourses, not something that can be solved with math.
I quite like the licensing trick Nintendo used on the gameboy as an example of this. [0] Essentially, the gameboy expected a bitmap of the Nintendo logo to be present on the cartridge rom, and was shown on screen at boot. It had to match a version stored on the gameboy itself or else the game wouldn’t start. The thinking (that I’m not sure was ever tested) was that someone producing a game that tried to trick consume…
The thinking was tested (in U.S. jurisdiction) in Sega v. Accolade. https://en.wikipedia.org/wiki/Sega_v._Accolade
The court sensibly ruled that using technical means to force competitors to display your trademark against their will doesn’t mean you can then claim they’re infringing that trademark.
Re: The Curious Case of MD5
#25I read through this hoping to have a reasonable discussion of the difference between preimage attacks (see https://en.m.wikipedia.org/wiki/Preimage_attack ) and was disappointed when I did not see the topic mentioned once. :( It is much more computationally feasible to create two inputs from scratch that hash to the same value than to forge an existing documents hash (the threat model I’m assuming they’re discussing…
Yes, if you haven't already noticed, crypto is just a religion at this point, propagated by the "experts" who don't actually think and actively silence dissent.
Re: The Curious Case of MD5
#26Earlier quoted context omitted.
This is more or less what I learned when I worked on forensics software, the kind that was supposed to maintain this kind of chain of custody/integrity. Like most things that touch the legal system, the presumption is that dishonesty or unsoundness in the chain of custody is fundamentally a legal problem with legal recourses, not something that can be solved with math.
I quite like the licensing trick Nintendo used on the gameboy as an example of this. [0] Essentially, the gameboy expected a bitmap of the Nintendo logo to be present on the cartridge rom, and was shown on screen at boot. It had to match a version stored on the gameboy itself or else the game wouldn’t start. The thinking (that I’m not sure was ever tested) was that someone producing a game that tried to trick consume…
[deleted]
Re: The Curious Case of MD5
#27This is the same legal system that still uses polygraphs as “lie defectors” and known-junk DNA matching tests as fact, so this isn’t exactly shocking.
What court has admitted polygraph test results into evidence? Surely, none in the US.
They are often used in pre-employment screening for sensitive government jobs. Yes, it would be illegal for a private employer to do this.
Re: The Curious Case of MD5
#28MD5 is incredibly broken. The PDF file PoC||GTFO 0x14 ( https://dl.packetstormsecurity.net/mag/pocgtfo/pocorgtfo14.p... , 42MB large) is a PDF file that can be also run in a NES emulator, and will display its own MD5 hash. The MD5 hash is also shown in the pdf document itself. (Don't download it from archive.org, their copy is altered) The fact that any document can contain its own MD5 hash embedded in there should b…
> a PDF file that can be also run in a NES emulator, and will display its own MD5 hash. The MD5 hash is also shown in the pdf document itself.
By that logic, SHA 256 is also broken:
$ cat >sha256.py
from hashlib import sha256
s = 'from hashlib import sha256\ns = %r\nprint sha256(s%%s).hexdigest()\n'
print sha256(s%s).hexdigest()
$ sha256sum sha256.py
14cc85c420ced317fdb73e9403ac3f6e1d96d19c70ae0dce8da9b8d96fa0b4d3 sha256.py
$ python sha256.py
14cc85c420ced317fdb73e9403ac3f6e1d96d19c70ae0dce8da9b8d96fa0b4d3
Re: The Curious Case of MD5
#29MD5 is incredibly broken. The PDF file PoC||GTFO 0x14 ( https://dl.packetstormsecurity.net/mag/pocgtfo/pocorgtfo14.p... , 42MB large) is a PDF file that can be also run in a NES emulator, and will display its own MD5 hash. The MD5 hash is also shown in the pdf document itself. (Don't download it from archive.org, their copy is altered) The fact that any document can contain its own MD5 hash embedded in there should b…
> a PDF file that can be also run in a NES emulator, and will display its own MD5 hash. The MD5 hash is also shown in the pdf document itself. By that logic, SHA 256 is also broken: $ cat >sha256.py from hashlib import sha256 s = 'from hashlib import sha256\ns = %r\nprint sha256(s%%s).hexdigest()\n' print sha256(s%s).hexdigest() $ sha256sum sha256.py 14cc85c420ced317fdb73e9403ac3f6e1d96d19c70ae0dce8da9b8d96fa0b4d3 sh…
Don't be silly here, the MD5 is clearly in the plaintext here, and the NES ROM is only the first 40k of the file. It is not able to scan itself and print out a hash that way.
Re: The Curious Case of MD5
#30Earlier quoted context omitted.
> a PDF file that can be also run in a NES emulator, and will display its own MD5 hash. The MD5 hash is also shown in the pdf document itself. By that logic, SHA 256 is also broken: $ cat >sha256.py from hashlib import sha256 s = 'from hashlib import sha256\ns = %r\nprint sha256(s%%s).hexdigest()\n' print sha256(s%s).hexdigest() $ sha256sum sha256.py 14cc85c420ced317fdb73e9403ac3f6e1d96d19c70ae0dce8da9b8d96fa0b4d3 sh…
Don't be silly here, the MD5 is clearly in the plaintext here, and the NES ROM is only the first 40k of the file. It is not able to scan itself and print out a hash that way.
> the MD5 is clearly in the plaintext here
Alright, I'll bite: at what byte offset in the binary file contents does a trivial encoding[0] of the MD5 hash occur?
> the NES ROM is only the first 40k of the file. It is not able to scan itself and print out a hash that way.
It is possible to encode the effects of multiple blocks of arbitrary[1] data on a hash function internal state (independently of what state you start in) in much less space than that data actually takes up, although I'll grant that actually doing so is somewhat impressive in it's own right, so I don't have a trivial translation to SHA 256 immediately ready to post.
Edit: tracked down my saved version:
$ md5sum pocorgtfo14.pdf
5eaf00d25c14232555a51a50b126746c pocorgtfo14.pdf
$ grep -aoi 5eaf00d pocorgtfo14.pdf || echo not found
not found
$ # using ...b126746c because 5eaf00... has a nul
$ grep -aoF $(printf '\xb1\x26\x74\x6c') pocorgtfo14.pdf || echo not found
not found
0: Eg, I'd accept 31 34 63 63 38 35 63 34 ... as an encoding of 14cc85c4... from above.
1: Including random/incompressible data.