the `==` trick only works with php 5.4.3 and earlier about hashes HOT 10 CLOSED

I've now grouped plaintext tricks by version supporting these. Thanks again @photodude.

from hashes.

Thanks, but no, sorry, all of the MD5 and SHA-1 examples were generated using PHP 5.5+ and work even in PHP 7.1.0, it's actually pretty easy to verify: https://3v4l.org/mAWt0

The overflow trick you're talking about works in a different way, see https://3v4l.org/uPvAJ and https://3v4l.org/581R5, it boils down to this:

'0e462097431906509019562988736854' == '0e830400451993494058024219903391'; // true everywhere
'123456789012345678901234567890' == '123456789012345678900000000000'; // false in PHP 5.4.4+

Spot the difference, there's 0e at the beginning of the strings on the first line enabling the trick in this case.

But you're totally right with the plaintext list, I'll update it. Thanks.

from hashes.

So if I understand the difference, it's a form of Integral strings that underflow as floating point numbers resulting in conditions where the two strings are equal under == since they result in 0 on evaluation.

Thanks @spaze for grouping the plaintext tricks. It's definitely more clear when and where these might have collisions.

from hashes.

It's definitely more an under- than an overflow, but I'd say it's neither. These XeY numbers are just an exponential representation of X×10^Y.

from hashes.

I find it interesting that 0eY is allowing collisions but Xe0 is not. Seems someone realized that 10^0 == 1 but forgot to consider 0^10 == 0

from hashes.

Well, Xe0 is always X so I don't see how Ze0 could give the same number as Xe0.

from hashes.

exponent math. Xe0 == X×10^0 == 1 basicly any number raised to power 0 is 1. https://www.mathsisfun.com/exponent.html

I believe you are thinking of the case Xe1 which is always just X since any number raised to the power 1 is just that number.

from hashes.

Dude, nope. X×10^0 is X, exponent math and order of operations. 10^0 is 1, multiplied by X is X. Just consult Wolfram Alpha or https://3v4l.org/puZjS

from hashes.

I see what your saying, I misread what I though I was seeing. Sometimes you only see what you expect to see.

from hashes.

That's correct, and especially in math :-)

from hashes.