Scraped from SlashDot a week ago, there's an effort afoot to use the "Chinese Lottery" attack against the MD5 function to find collision. In other words, there is an attempt to use massively parallel computing to find an two inputs that, when passed through the MD5 function, produce the same output.
While at first glance this may seem innocuous, it is not. Basically, it's an attack on a cryptographic function. Keep in mind that "attacks on cryptographic functions" are not necessarily a bad thing. Like just about anything else, they can be used for good or evil.
What is especially interesting about this specific "attack" is the manner in which they are going about getting the "massively parallel" computing power. It's in the form of a Java applet that they are asking webmasters to add to their sites. This results in each visitor to a website contributing processing power to the project for the amount of time that the user leaves the browser page open on that web site.
Innocuous again? Maybe. It's also something that can be used for evil. Anyone remember a certain virus that got around by adding a bit of code to web sites and also highjacked the (invisible) browser of the user that visited that site? In this case, it asks the webmaster to trust someone else's code and gives the site visitor little or no choice in the matter.
No comments:
Post a Comment