Logical Analysis and Verification of Cryptographic Protocols - Loria

3.2. COLLISION VULNERABILITY PROPERTY 61
two distinct inputs x and x ′ with h(x) = h(x ′ ) provided that x and x ′ are created
at the same time and independently one of the other.
To mount a collision attack, the intruder would typically begin by constructing
two different messages with the same hash where one message appears
legitimate or innocuous while the other serves the intruder’s purposes.
3.2.1 Hash functions having this property
MD5 Hash function [173] is one of the most widely used cryptographic hash
functions nowadays. It was designed in 1992 as an improvement on MD4 [172],
and its security was widely studied since then by several authors. The first
result was a pseudo-collision for MD5 [98]. When permitting to change the
initialisation vector, another attack (free-start collision) has been found [103].
Recently, a real collision involving two 1024-bits messages was found with the
standard value [199]. This first weakness was extended into a differential-like
attack [202] and tools were developed [129, 130] for finding the collisions which
work for any initialisation value and which are quicker than methods presented
in [199]. Finally, other methods have been developed for finding new MD5
collisions [204, 183]. The development of collision-finding algorithms is not
restricted to MD5 hash function. Several methods for MD4 [172] research attack
have been developed [200, 104]. In [200] a method to search RIPEMD [105]
collision attacks was also developed, and in [42], a collision on SHA-0 [7] has
been presented. Finally, Wang et al. have developed in [201] another method to
search for collisions for the SHA-1 [4] hash function.
3.2.2 Collision vulnerability in practice
We consider here the story of Alice and her boss [94]. Alice has been working for
some time in the office of Julius Caesar. On her last day of work, Caesar gives
her a letter of recommendation on paper. Alice decides to take advantage of this
opportunity to gain access to Caesar’s secret documents. Caesar uses MD5 hash
function which is collision vulnerable (Section 3.2.1) for his digital signature
scheme DSA [3]. When she receives her letter of recommendation on paper,
Alice prepars two postscripts files with the same MD5 hash: one is the letter
given by Caesar and the other is an order from Caesar to grant Alice some kind
of secrecy clearance. She asks Caesar to digitally sign the letter and due to the
hash collision, Caesar’s signature for the letter of recommendation is also valid
for the order. She then presents the order and the digital signature to the person
in charge of Caesar’s files, and finally gains access to Caesar’s secret documents.