ronny.haryan.to

Another MD5 collision has been found. They provide two files as a proof of concept. These are practical, not theoretical, real-life (looking) files.

 ronny@mambo:~/m$ ls -l
 total 8
 -rw-r--r--  1 ronny users 2029 Jun 11 00:20 letter_of_rec.ps
 -rw-r--r--  1 ronny users 2029 Jun 11 00:20 order.ps
 ronny@mambo:~/m$ diff letter_of_rec.ps order.ps
 Files letter_of_rec.ps and order.ps differ
 ronny@mambo:~/m$ md5sum letter_of_rec.ps order.ps
 a25f7f0b29ee0b3968c860738533a4b9  letter_of_rec.ps
 a25f7f0b29ee0b3968c860738533a4b9  order.ps

Should we start considering replacing or even combining MD5 usage with “stronger” alternatives like SHA or Tiger? Any others?

(via Bruce Schneier)