Sergei Gorelkin schrieb: > Friday, November 24, 2006, 12:36:35 PM, Bram wrote: > > BK> A.J. Venter wrote: >>> That seemed to work fine - except it turns out that MD5 is even LESS >>> reliable >>> than I thought, at least on small data. >>> I had a bug report (and confirmed it) that you can log into anybody's >>> account >>> if you simply know how many characters his password has. >>> >>> Apparently '123456' generates exactly the same MD5SUM as 'beebob' (for any >>> particular set of values) ! > > BK> This is not the case for the MD5 algorithm as defined in RFC 1321. > > BK> $ echo 123456|md5sum > BK> f447b20a7fcbf53a5d5be013ea0b15af *- > > BK> $ echo beebob|md5sum > BK> bd9dc720ce0f1976d760a803c1d12370 *- > > I've just tested FPC functions (in packages/base/hash/md5.pp). > Surprisingly (and providing ground for investigation!), it gives different > results:
Well, md5sum even gives different results for the rfc 1321 test suite while fpc's implementation gives the correct results. > > program: > Writeln('MD5 (''123456''): ', MDPrint(MDString('123456', 5))); > Writeln('MD5 (''beebob''): ', MDPrint(MDString('beebob', 5))); > > output: > MD5 ('123456'): e10adc3949ba59abbe56e057f20f883e > MD5 ('beebob'): 95ee914c147ed0d25a9064d0c3ce2019 > > Nevertheless, two given strings have different hash values, as they > should. > > BK> Maybe you somehow only hash the string length? E.g. you do a > md5(password[1])? > > Most probably, this or similar bug is the case. Even weak stuff like > CRC must give different results for different strings... > _________________________________________________________________ To unsubscribe: mail [EMAIL PROTECTED] with "unsubscribe" as the Subject archives at http://www.lazarus.freepascal.org/mailarchives