It is not a vulnerability, but it can be cracked. Relevant information is as follows: At the International Cryptozoology Conference (Crypto'2004) in Santa Barbara, California, on August 17, 2004, Professor Wang Xiaoyun from Shandong University in China gave a report on deciphering the MD5, HAVAL-128, MD4 and RIPEMD algorithms. Announced the cracking results of MD series algorithms. The fortress of MD5, the world's most impregnable cryptographic standard, collapsed, triggering an uproar in the cryptography community.
What the world's top cryptographers could not imagine was that after cracking MD5, in February 2005, Professor Wang Xiaoyun cracked another international password, SHA-1. Because SHA-1 is more widely used in the United States and other international communities, the news that the password was broken caused a shocking response in the international community. In other words, Wang Xiaoyun's research results show that in theory, electronic signatures can be forged, and restrictions must be added in time, or more secure password standards must be re-selected to ensure the security of e-commerce.
The authoritative website of MD5 Cracking Project was established to publicly solicit attacks specifically targeting MD5. The website announced on August 17, 2004: "Chinese researchers have discovered a collision of the complete MD5 algorithm; Wang, Feng , Lai and Yu announced the collision of several Hash functions such as MD5, MD4, HAVAL-128, and RIPEMD-128. This is the most substantial research progress in the field of cryptography in recent years, using their technology within a few hours. The MD5 collision can be found... As a result of this landmark discovery, the MD5CRK project will be concluded within the next 48 hours."
Before August 2004, the international cryptography community was not familiar with the name Wang Xiaoyun. In August 2004, at the International Cryptozoology Conference held in Santa Barbara, California, Professor Wang Xiaoyun, who was not scheduled to speak, approached the chairman of the conference with his research results. Unexpectedly, the discerning chairman of the conference made an exception and gave her 15 Minutes to introduce their results, while usually speakers are only allowed two or three minutes. Wang Xiaoyun and his research colleagues demonstrated hash collisions of MD5, SHA-0 and other related hash functions. The so-called hash collision means that two completely different messages result in exactly the same hash value calculated by a hash function. According to the pigeonhole principle, when a hash function with a length limit is used to calculate a message without a length limit, collisions will inevitably occur. However, computer security experts have always believed that it would take too long to create a collision at will, and it is impossible to happen in actual situations. The discovery of Wang Xiaoyun and others may break this inevitability. In this way, Wang Xiaoyun announced for the first time at an international conference the research results of her and her research team in recent years - the deciphering results of four famous cryptographic algorithms, including MD4, MD5, HAVAL-128 and RIPEMD.
When the third result was announced, applause broke out in the venue, and the report had to be interrupted for a while. After the report, all the experts present gave them a long round of applause for their outstanding work, and some scholars even stood up and applauded to show their congratulations and admiration. Due to a version problem, the set of constants used by the author when submitting the conference paper were different from the prior standards. After discovering this problem, Professor Wang Xiaoyun immediately changed the constants and completed the new data analysis in a very short time. This The near-miss episode further proved the convincingness of their paper, the effectiveness of the attack method, and verified the success of the research work.
What the world's top cryptographers could not imagine was that after cracking MD5, in February 2005, Wang Xiaoyun and his colleagues proposed a hash collision of the SHA-1 hash function. Because SHA-1 is more widely used in the United States and other international communities, the news that the password was broken caused a shocking response in the international community. In other words, Wang Xiaoyun's research results show that in theory, electronic signatures can be forged, and restrictions must be added in time, or more secure password standards must be re-selected to ensure the security of e-commerce.
In August 2005, Wang Xiaoyun, Yao Qizhi, and Yao Qizhi’s wife Yao Chufeng (the person who named Knuth Knuth) jointly proposed the SHA-1 hash function hash collision calculation at the end of the International Cryptozoology Conference. An improved version of the law. This improved version shortens the time to crack SHA-1.
On June 8, 2006, Professor Wang Xiaoyun was awarded the Tan Kah Kee Science Award for Information Technology Science at the 13th Academician Conference of the Chinese Academy of Sciences and the 8th Academician Conference of the Chinese Academy of Engineering for "Cracking the International Universal Hash Function" award.
Not many people can crack this... not to mention how troublesome this kind of project is