Bit-Free Collision: Application to APOP Attack
This paper proposes a new variant of collisions on hash functions named bit-free collision, which can be applied to reduce the number of chosen challenges in password recovery attacks on hash-based challenge and response protocols, such as APOP (Authentication Post Office Protocol). In all previous APOP attacks, the attacker needs to impersonate the server and to send poisoned chosen challenges to the user. Impersonating the server takes a risk that the user may find out he is being attacked. Hence, it is important for the attacker to reduce the number of impersonation in order to lower the probability that the attack will be detected. To achieve this, reducing the number of chosen challenges is necessary. This paper is the first approach to improve previous APOP attacks based on this observation to our best knowledge. With t-bit-free collisions presented in this paper, the number of chosen challenges to recover each password character can be reduced by approximately a factor of 2t. Though our attack utilizing t-bit-free collisions needs higher offline complexity than previous attacks, the offline computation can be finished in practical time if the attacker can obtain reasonable computation power. In this research, we generate 1-bit-free collisions on MD5 practically. As a result, the number of challenges for password recovery attacks on real APOP is approximately half reduced. Of independent interest, we apply the bit-free-collision attack on a simpler hash function MD4, and show that 3-bit-free collisions can be generated practically.
Keywordshash function bit-free collision APOP MD5 MD4
Unable to display preview. Download preview PDF.
- 1.Biham, E., Chen, R.: Near-collisions of SHA-0. In: Franklin, M. (ed.) CRYPTO 2004. LNCS, vol. 3152, pp. 290–305. Springer, Heidelberg (2004)Google Scholar
- 3.Damgård, I.: A design principle for hash functions. In: Brassard, G. (ed.) CRYPTO 1989. LNCS, vol. 435, pp. 416–427. Springer, Heidelberg (1990)Google Scholar
- 4.Joux, A.: Multicollisions in iterated hash functions. Application to cascaded constructions. In: Franklin, M. (ed.) CRYPTO 2004. LNCS, vol. 3152, pp. 306–316. Springer, Heidelberg (2004)Google Scholar
- 5.Klima, V.: Tunnels in Hash Functions: MD5 Collisions Within a Minute. Cryptology ePrint Archive, Report 2006 /105, http://eprint.iacr.org/2006/105.pdf
- 7.Merkle, R.C.: One Way Hash Functions and DES. In: Brassard, G. (ed.) CRYPTO 1989. LNCS, vol. 435, pp. 428–446. Springer, Heidelberg (1990)Google Scholar
- 8.Myers, J., Rose, M.: Post Office Protocol - Version 3. RFC 1939 (Standard), Updated by RFCs 1957, 2449 (May 1996), ftp://ftp.isi.edu/in-notes/rfc1939.txt
- 9.Rivest, R.L.: The MD4 Message Digest Algorithm. Request for Comments (RFC 1320), Network Working Group (1992)Google Scholar
- 10.Rivest, R.L.: The MD5 Message Digest Algorithm. Request for Comments (RFC 1321), Network Working Group (1992)Google Scholar
- 11.Sasaki, Y., Yamamoto, G., Aoki, K.: Practical Password Recovery on an MD5 Challenge and Response. Cryptology ePrint Archive, Report 2007/101Google Scholar
- 14.Wang, X., Lai, X., Feng, D., Chen, H., Yu, X.: Cryptanalysis of the hash functions MD4 and RIPEMD. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 1–18. Springer, Heidelberg (2005)Google Scholar
- 15.Wang, X., Yu, H.: How to break MD5 and other hash functions. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 19–35. Springer, Heidelberg (2005)Google Scholar