Hi!
When I look at this, I get totally different results. First, there are several
differences between the files (not just the one that your cmp command shows).
Second, the MD5s are not only difefrent, they don't match the calculation you
provide....
I get...
C:\> dir data*.txt
Volume in drive C has no label.
Volume Serial Number is 07D1-051D
Directory of C:\MYPROG~1\forensics
11/15/2004 14:10 400 data1.txt
11/15/2004 14:10 400 data2.txt
2 File(s) 800 bytes
0 Dir(s) 852,140,032 bytes free
C:\> type data1.txt
d1 31 dd 02 c5 e6 ee c4 69 3d 9a 06 98 af f9 5c
2f ca b5 87 12 46 7e ab 40 04 58 3e b8 fb 7f 89
55 ad 34 06 09 f4 b3 02 83 e4 88 83 25 71 41 5a
08 51 25 e8 f7 cd c9 9f d9 1d bd f2 80 37 3c 5b
96 0b 1d d1 dc 41 7b 9c e4 d8 97 f4 5a 65 55 d5
35 73 9a c7 f0 eb fd 0c 30 29 f1 66 d1 09 b1 8f
75 27 7f 79 30 d5 5c eb 22 e8 ad ba 79 cc 15 5c
ed 74 cb dd 5f c5 d3 6d b1 9b 0a d8 35 cc a7 e3
C:\> type data2.txt
d1 31 dd 02 c5 e6 ee c4 69 3d 9a 06 98 af f9 5c
2f ca b5 07 12 46 7e ab 40 04 58 3e b8 fb 7f 89
55 ad 34 06 09 f4 b3 02 83 e4 88 83 25 f1 41 5a
08 51 25 e8 f7 cd c9 9f d9 1d bd 72 80 37 3c 5b
96 0b 1d d1 dc 41 7b 9c e4 d8 97 f4 5a 65 55 d5
35 73 9a 47 f0 eb fd 0c 30 29 f1 66 d1 09 b1 8f
75 27 7f 79 30 d5 5c eb 22 e8 ad ba 79 4c 15 5c
ed 74 cb dd 5f c5 d3 6d b1 9b 0a 58 35 cc a7 e3
C:\> comp data1.txt data2.txt
Comparing data1.txt and data2.txt...
Compare error at OFFSET 3B
file1 = 38
file2 = 30
Compare error at OFFSET 8C
file1 = 37
file2 = 66
Compare error at OFFSET B8
file1 = 66
file2 = 37
Compare error at OFFSET 103
file1 = 63
file2 = 34
Compare error at OFFSET 154
file1 = 63
file2 = 34
Compare error at OFFSET 180
file1 = 64
file2 = 35
C:\> sha_verify data1.txt
File: data1.txt
MD5 45883E27BC7CA9620C624EC7E2CA9D32
SHA 1B5D28848C7565BBACBBFE1A1856550F3DF55F52
C:\> sha_verify data1.txt
File: data2.txt
MD5 CF134C66A619A605CBB5228715D10B4A
SHA AF39874FFE2056A48778CF6C63828A2ABC53AAF7
/kess
At 23:14 11/11/2004 +0100, Hrvoje Spoljar wrote:
On Wed, 2004-11-10 at 19:44, ¥ dosman ¥ wrote:
Actually MD5 hasn't been broken... yet. A close cousin to MD5 was broken,
not the actual MD5 as we know it. It's still safe to use MD5 for the time
being. However I would be on the look out for a replacement if and when one
becomes available. Sure there's SHA1, but of course a pair of digests to
compliment each other is prefered.
snip from http://www.tcs.hut.fi/~mjos/md5/
file1.dat:
00000000 d1 31 dd 02 c5 e6 ee c4 69 3d 9a 06 98 af f9 5c
00000010 2f ca b5 87 12 46 7e ab 40 04 58 3e b8 fb 7f 89
00000020 55 ad 34 06 09 f4 b3 02 83 e4 88 83 25 71 41 5a
00000030 08 51 25 e8 f7 cd c9 9f d9 1d bd f2 80 37 3c 5b
00000040 96 0b 1d d1 dc 41 7b 9c e4 d8 97 f4 5a 65 55 d5
00000050 35 73 9a c7 f0 eb fd 0c 30 29 f1 66 d1 09 b1 8f
00000060 75 27 7f 79 30 d5 5c eb 22 e8 ad ba 79 cc 15 5c
00000070 ed 74 cb dd 5f c5 d3 6d b1 9b 0a d8 35 cc a7 e3
MD5(file1.dat) = a4c0d35c95a63a805915367dcfe6b751
file2.dat:
00000000 d1 31 dd 02 c5 e6 ee c4 69 3d 9a 06 98 af f9 5c
00000010 2f ca b5 07 12 46 7e ab 40 04 58 3e b8 fb 7f 89
00000020 55 ad 34 06 09 f4 b3 02 83 e4 88 83 25 f1 41 5a
00000030 08 51 25 e8 f7 cd c9 9f d9 1d bd 72 80 37 3c 5b
00000040 96 0b 1d d1 dc 41 7b 9c e4 d8 97 f4 5a 65 55 d5
00000050 35 73 9a 47 f0 eb fd 0c 30 29 f1 66 d1 09 b1 8f
00000060 75 27 7f 79 30 d5 5c eb 22 e8 ad ba 79 4c 15 5c
00000070 ed 74 cb dd 5f c5 d3 6d b1 9b 0a 58 35 cc a7 e3
MD5(file2.dat) = a4c0d35c95a63a805915367dcfe6b751
Once you have downloaded these files you can easily verify (in UNIX shell)
that this is indeed a collision for MD5:
$ cmp file1.dat file2.dat
file1.dat file2.dat differ: char 20, line 1
$ md5sum file1.dat
a4c0d35c95a63a805915367dcfe6b751 file1.dat
$ md5sum file2.dat
a4c0d35c95a63a805915367dcfe6b751 file2.dat
that's my 2c
p.s.
dosman ... mabey your relative winman uses M$ md5 ?:))
nhf man...
--
________ ___ __ ___
/ __) . \ \ | | __) Hrvoje ?poljar ICQ: 53000945
|__ | |__/ | |_| __) http://spole.pbf.hr/ irc.oftc.net#RoCkY
(____'__| \___/___|___) hrvoje.spoljar@x.pbf.hr mobile: 0989291593
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
=========================================================================
Gary C. Kessler gary.kessler@champlain.edu
Associate Professor Project Director
Program Dir., Computer & Digital Forensics Information Security
Program Dir., Computer Networking Vt. Information Technology Ctr.
Champlain College Office: +1 802-865-6460
West Hall, Room 12 Fax: +1 802-865-6447
163 South Willard Street Cell: +1 802-238-8913
Burlington, VT 05401
http://digitalforensics.champlain.edu kumquat@sover.net
http://networking.champlain.edu http://www.garykessler.net
PGP Public Key: http://www.garykessler.net/kumquat_pubkey.html
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
