[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CABh=JRGAsP-bfpWsAVfay1xHkr6gbL+3WXB=fyGKfAEyOtEXHA@mail.gmail.com>
Date: Fri, 29 Jun 2012 15:26:50 +0300
From: Milen Rangelov <gat3way@...il.com>
To: john-dev@...ts.openwall.com
Subject: Re: Re: Re: md5 internals question
Hello,
If we select D from round 64, we can predict all the bits that influence it
> without knowing the input back until A48. This is because it mixes in W
> bits
> at R60 from W[4] (all zero), R56 from W[8] (all zero), R52 from W[12] (all
> zero), and finally R48 from (unfortunately) W[0], which is part of the
> input
> message and cannot be predicted.
>
> So we manage to skip 3 rounds that mix in input bits, and so for the common
> case only have to do 48 rounds!
>
>
W[0] is not the stopper. You can skip some more steps past 48 provided that
you can keep W[1]..W[3] constant for the reverse calculations. You may
check that thread:
http://3.14.by/forum/viewtopic.php?f=8&t=47
Regards,
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
