Merkle-Damgard

S = F(S, B)

Basic operation

Block (B) - Fixed size

In State (S)

Fixed size

Out State (S)

Fixed size

This function let's you hash a fixed size message.

Merkle-Damgard

Basic operation

• The "F" function for MD5 :
  
  https://gist.github.com/HoLyVieR/11e464a91b290e33b38e#file-md5-py-L230
   
• Name that you will see in other implementation
  • transform
  • md5_compress
     
• The "state" parameter is often defined as a class variable.

Merkle-Damgard

Hashing variable length message

• Block chaining
  • Requires padding
  • The output of the last chain is the "hash".

Merkle-Damgard

Padding

• For MD5
  • Append "\x80".
  • Append "\x00" until there's only 8 bytes to fill.
  • Append the size of the message on 8 bytes.
  • https://gist.github.com/HoLyVieR/11e464a91b290e33b38e#file-md5-py-L215

Merkle-Damgard

source : http://commons.wikimedia.org/wiki/File:Merkle-Damgard_hash_big.svg

Chaining

• The IV is a constant for the hashing algorithm
• MD5 doesn't have a finalisation step

Extension

Extension

• The output will be the hash of :
  • Initial message                            +
  • Padding of the initial message +
  • Appended message
     
• This is interesting because we can predict a hash output even if part of the initial message is unknown.

Challenges

• Main challenge
  • Win at the lottery
  • https://gist.github.com/HoLyVieR/bbbe95bfa492ef57fd62
     
• Extra challenge
  • Find the value of "FIND_ME"
  • https://gist.github.com/HoLyVieR/947bedcb763df27f3e9a

IP : 172.20.64.108

Challenges

• Hints (1)
  • Part of the output of the hash can obtained by setting the odds really high !
  • Figure a way to test missing bytes.

Challenges

• Hints (1)
  • Part of the output of the hash can obtained by betting a lot of money !
  • Figure a way to test missing bits.
    
    
• Hints (2)
  • To test the missing bits, bid
    • "a" = XXXXab87a7b88a8a.... = H(S + "a" + padding)
    • "a" + padding + "b" = H(S + "a" + padding + "b" + padding)
  • Bruteforce the missing bits of the 1st bid until the extension gives output the 2nd bid.
  • You can now predict the output, bid wisely and make a lot cash.

Challenges

• Solutions
  • https://gist.github.com/HoLyVieR/2224af63adb804b68cef
  • https://gist.github.com/HoLyVieR/912a7769e90ded9fcda3