in reply to Re^5: compare images
in thread compare images
it may be conceivable to forge two different files sharing more than one digest type !
Possible, but given the 'simultaneous' nature of the problem of forging a single document that matches two (or more), separate, and different checksums, means that the task gets a whole lot tougher than just a simple multiplier effect. With each change of a bit having a different effect on each of the checksums, just generating one document to match both signatures is incredibly hard. Doing so whilst creating a document that actually says something meaningful, and relevant to your nefarious means is tougher still.
The postscript example above is really a cheat. The majority of the change appears to be a "markup" change that simply conceals the major bulk of the original message--which just so happens to leave the remainder of the message suitable for the nefarious purpose.
In the absence of a carefully contrived starting point deliberately conducive to the nefarious purpose, even this "conceal the stuff that you don't want" method is really quite hard and unlikely. The fact that simply opening the document in a plain text editor shows the original content, makes it more than a little suspect as a useable technique for anything other than demonstration purposes. Interesting, but mostly irrelavent.
My challenge still stands--though not without a little trepidation. I reserve the right to change the nature of the challenge to using one MD5 wrapped around an message with an embedded digest of some other form (say SHA1 or similar), as the power of cpus and gridded networks rises, and the art of of digital forgery gets more sophisticated, but I'm not ready to wimp out yet :)
|
|---|