Talk

Hash collision exploitation

Hash collision exploitation

workshop 2019-11-07 14:00 – 17:00 TR4 EN-FR

Hash collision exploitation

A system indexes files by MD5. How secure is it?

This workshop is an introduction to file manipulations, hash collisions attacks and how to combine both to exploit them.
It doesn't require any cryptographic knowledge.
It covers all existing hash collisions attacks for MD5 and SHA1:

  • Identical Prefix collisions: FastColl, then Unicoll.
    • the PNG format and develop instant MD5 collisions via UniColl.
    • the GIF format and develop instant MD5 collisions via FastColl.
  • Chosen prefix collisions: HashClash.
  • Collisions chaining and combining.
  • Shattered (SHA1)
Note this is not about password cracking (hash cracking), but hash collision: ie, making 2 files of arbitrary contents with the same MD5 value.