Version 0.5

===============
What's new ?
===============

*A benchmark mode "-t secs" is now available, it performs a speed test during a customizable duration.
Usefull for benchs report/comparaisons.


Version 0.4

===============
What's new ?
===============

*Complete optimization of the original rivest's  C implementation
of the md5 generator.
*Other optimizations
*Overall performance enhancement, about 50% faster.
*Makefile is more verbose
*statistics when CTRL-C or ending a crack are more reliable, using a precision
of one millisecond. 
*Bug fixe: Statistic won't be no longer weird after less than 1 second of crack.

Version 0.3

===============
What's new ?
===============

*Sources sanity check 
*various optimizations/bug fixes.



Version 0.2

===============
What's new ?
===============

*When stopped with ctrl-c, any session will be automaticaly saved in a temp
file /tmp/.mdcrack.resume to be continued later.
While starting, mdcrack now check for a temp file and will automaticaly
resume a previously stopped session.
This can be really usefull for multiboot systems and/or "many days" crack jobs.

*option -h will show the help online.

===============
MDcrack
===============

MD5 is a one way hash algorithm providing a final 128 bits length hash whatever was the original text length.
The resulting hash is often used to sign a document thus giving a way to certify that the original content wasn't altered by a third party. 
Today many applications (most of them are network oriented) use MD5 for authentication purpose avoiding any plain text password on the wire. 
In such a case, clients typically send a password hash over the network to the server wich in turn, make its own client password hash to compare the two hashes.
If they match together, the server considere the client know the good password and the authentication process is ended althought the server may be totaly wrong !
MD5 can not theoricaly be reversed that is to say nobody can guess the original text from its hash (even with little strings like passwords) but since the number of resulting hash is fixed (2^128), many strings will give the same hash.
Surveys about the predictibility of such collisions have never, till now,  prooved that somebody could arbitrary choose another text giving the same MD5 signature.
In the worst case, a third party may change the original text with something that has no signification at all and the well known birthday attack is easily defeated with some few precautions.
Nevertheless if a random collision is not really a problem for a letter that needs to have sense, it may be a valuable threat for a MD5 password authentication scheme.
Imagine that a user A authenticate himself sending his hash on the wire to the server B while being sniffed by an attacker X who easily catch the hash.
Our attacker doesn't only want the hash but need an original plain text password( this is the case with the hotmail messenger vulnerability, i reported to bugtraq this month ).
He doesn't actually need the same password but any collision that can be typed from a real client.
If the chance are low for your password to have a collision in the first hashes generation, the probability is not null and the attacker can still bruteforce your original password.
This is the purpose of MDcrack, it will give you any found collision in the range you will have previously defined and could be usefull to test the strongness of your password hash.
Because MD5 will always give the same result for a given input, user may easily compute every combinaison of a fixed password length in advance to do further collision search using egrep. For big password size, many cray and a lot of time should be usefull ;) 

Have a nice day,

===============================================
compilation -- make
test -- make test
===============================================

this program is based on the original 
MD5 C implementation from Ron Rivest (RSA).


===============================================
Questions, bugs reports, ideas for optimization
 to c3rb3r@hotmail.com
===============================================
 
Gregory Duchemin
NEUROCOM CANADA
1001 bd Maisonneuve Ouest, suite 200
Montreal, Quebec, H3A 3C8 Canada.

 

