C0D3 CR4CK3D: Means and Methods to Compromise Common Hash Algorithms

There are currently several different hashing algorithms in use today. These include LM, MD5, SHA-1, and SHA-2, among many others. We use these algorithms for many different purposes - data fingerprinting, digital signatures, and message authentication codes. In these applications, there is one common element - the hashing algorithm takes a piece of data that is likely bigger in size and reduces it to a shorter, unique identifier, called a hash. If the data changes in a slight way, the resulting hash can change quite drastically, some times impacting ~50% of the bits in the resulting hash (1). Furthermore, to create the same hash from two different data elements becomes increasingly more difficult as the length of the hash increases. These algorithms and the resulting hash, were designed to provide security and confidence to the user that the data is authentic. What happens when two different data elements create the same hash? The entire security and usefulness of the hashing algorithm falls under scrutiny. Simply proving that a particular hash algorithm can be compromised in our lifetime can also create enough alarm to send cryptographers back to the drawing board. Many cryptanalysts see this as a challenge - to the unbreakable - and dedicate their lives to break these algorithms. In this paper, I will discuss the means and methods that cryptanalysts use to compromise several hash algorithms. I will also discuss ways to decrease the opportunity for a compromise of a hash or its source data.