The 1337 PNG Hashquine | Hackaday

A hashquine is a exciting way to display off your crypto-tricks — It’s a file that includes its personal hash. In some file varieties it is trivial, you just pick the hash to strike, and then set random info in a comment or other invisible subject till you get a collision. A Python script that prints its own hash would be easy. But not every file style is so quick. Take PNG for instance. these documents are break up into chunks of info, and each and every chunk is the two CRC-32 and adler32 checksummed. Make one particular improve, and every thing alterations, in a few sites at the moment. Excellent luck finding that collision. So how exactly did [David Buchanan] produce that attractive PNG, which does in actuality md5sum to the value in the image? Very cleverly.

Fortunately [David] shared some of his methods, and they’re quite neat. The procedure he particulars is a satisfy-in-the-middle hack, the place 36 pairs of MD5 collision blocks are identified, with the comprehension that these 36 blocks will get added to the file. For each individual block, both A or B of the pair will get plugged in at that spot, and the md5sum will not adjust. It’s a total of 2^36 achievable mixtures of these blocks, which is much more computation than was simple for this certain hack. The remedy is to pre-compute the success of each individual achievable mix of the initially 18 blocks, and retail outlet the effects in a lookup table. The next fifty percent of the collisions are operate backwards from a target CRC price, and the consequence checked from the lookup desk. Uncover a strike, and you just discovered a series of blocks that matches both of those your concentrate on md5sum and CRC32 results.

Many thanks to [Julian] for the suggestion! And as he described it, this hack is a person that gets far more impressive the far more you imagine about it. Appreciate!