How to mock MD5 hash collision

Question

I am using a private Ubuntu server and am testing a private application

I am using the Python hashlib library for generating MD5 hashes.

Now I want the MD5 function always return my specific number although different input. How can I do this? Is there a config file?

This is an [XY problem](http://meta.stackexchange.com/questions/66377/what-is-the-xy-problem). Tell us what you really want to do. — zvone, Oct 26 '16 at 05:38
I want to test my application using MD5. it is openstack swift. i have testing case about MD5 birthday. therefore i want to Md5 always has same output to examine my application that how it will handle that . — Nguyen Diep, Oct 26 '16 at 06:30
@NguyenDiep If it is in swift, then why do you mention Python in your post an why is it tagged python? — techydesigner, Oct 26 '16 at 07:06
@techydesigner because i see MD5 written by python and swift also. if not, please ignore it. — Nguyen Diep, Oct 27 '16 at 01:23

score 4 · Answer 1 · answered Oct 26 '16 at 05:37

4

DISCLAIMER

As mentioned in the comments this is most likely a TERRIBLE idea and is very likely an X / Y problem.

For the sake of clarity, this is what I was referring to when I said it could be done via a monkey patch:

import hashlib

class DummyMD5():

    def __init__(self, realmd5):
        self.md5 = realmd5
        self.v = None

    def hexdigest(self):
        return "12345abcdef"

    def __call__(self, v):
        self.v = v
        return self

    def __getattr__(self, f):
        if f not in self.__dict__:
            return self.md5(self.v).__getattribute__(f)




_md5 = hashlib.md5
hashlib.md5 = DummyMD5(_md5)

As long as this is imported / executed before the hashlib call is used elsewhere it will replace the result of a hexdigest with a constant value. Any other method would return the real md5 (like digest).

answered Oct 26 '16 at 05:37

sberry

128,281
18
138
165

how to use your DummyMD5? my application configuration is: from haslib import md5. then use MD5(path) to return output. – Nguyen Diep Oct 26 '16 at 06:20
1

This continues to be a terrible idea. Tell us what you really want to accomplish instead. – tripleee Oct 26 '16 at 07:42
@tripleee, my application use MD5 to hash path of object. i want to test in case if MD5 return same hash, what will happen. so that i want to change MD5 function to return same hash. – Nguyen Diep Oct 27 '16 at 01:25
2

Congratulations, you have invented [mocking](https://docs.python.org/3/library/unittest.mock.html). Unfortunately, this comment box is too small for a detailed tutorial. – tripleee Oct 27 '16 at 04:16

score -1 · Answer 2 · edited May 23 '17 at 12:32

tl;dr You can't, unless you write your own function or implement a monkey patch.

Hashes are not designed to return the same value for multiple completely different snippets of data (although inevitably there have been collisions, like with MD5, due to the length of the hash). You could write your own function to check the value passed, and have it return a unique value if you need to. An example:

import hashlib

def my_func(thing):
    hash_for_cheese = 'fea0f1f6fede90bd0a925b4194deac11'
    if thing == "cheese":
        return hash_for_cheese
    elif thing == "football":
        return hash_for_cheese
    else:
        return hashlib.md5(thing).hexdigest()

In this case, the same hash would be returned if you passed cheese or football to the function, otherwise it would return another hash.

Also, there is no 'config file'. It is just a specific algorithm written in a C program. If you are desperate, you might be able to change it, but it would only work on your system.

You could also implement what is known as a monkey patch. I'm not knowledgeable in that area, but you can find out more information from this SO post.

As others have pointed out, I can not think of a use case for this sort of problem, although if you need to do it, then you have your answer.

Not the downvoter, but sure you can. You can monkey patch if you really wanted to. This is a terrible idea, but it is very possible. — sberry, Oct 26 '16 at 05:25
What I meant when I said it was a bad idea was not specific to a monkey patching approach but to the general idea of returning a constant value for an md5 hash. I would be very surprised if there is a valid use case for such a thing. — sberry, Oct 26 '16 at 05:33
This is not true: "Hashes are not designed to return the same value *ever*", cryptographic hash functions are designed to make it *hard* to compute the same hash — Francisco, Oct 26 '16 at 05:47

How to mock MD5 hash collision

2 Answers2