The death of MD5

[iago]

Ok, that's pretty much what I figured.  Hashing it with the IP is probably the best plan, if I had to choose. 

But back to the MD5 thing: passwords stored in MD5 in cookies don't help you any unless you want to find a collision with his password for a different site that only accepts plaintext password, then compares it to MD5, which isn't really realistic. 

My point?  MD5 is still ok for storing passwords for webapps, in general.

[dxoigmn]

But back to the MD5 thing: passwords stored in MD5 in cookies don't help you any unless you want to find a collision with his password for a different site that only accepts plaintext password, then compares it to MD5, which isn't really realistic. 

Don't most sites accept a plain-text password, hash it server-side and compare? I wish there was a nice standard for hashing client-side (i.e. <input type="password" hash="md5"> or something).

[iago]

But back to the MD5 thing: passwords stored in MD5 in cookies don't help you any unless you want to find a collision with his password for a different site that only accepts plaintext password, then compares it to MD5, which isn't really realistic. 

Don't most sites accept a plain-text password, hash it server-side and compare?

Yeah, but if you're doing that you're sending your password plaintext over the network, so if you can sniff their traffic it doesn't matter if you can break md5..

[dxoigmn]

But back to the MD5 thing: passwords stored in MD5 in cookies don't help you any unless you want to find a collision with his password for a different site that only accepts plaintext password, then compares it to MD5, which isn't really realistic. 

Don't most sites accept a plain-text password, hash it server-side and compare?

Yeah, but if you're doing that you're sending your password plaintext over the network, so if you can sniff their traffic it doesn't matter if you can break md5..

But most sites use SSL to encrypt the whole stream.

[iago]

But back to the MD5 thing: passwords stored in MD5 in cookies don't help you any unless you want to find a collision with his password for a different site that only accepts plaintext password, then compares it to MD5, which isn't really realistic. 

Don't most sites accept a plain-text password, hash it server-side and compare?

Yeah, but if you're doing that you're sending your password plaintext over the network, so if you can sniff their traffic it doesn't matter if you can break md5..

But most sites use SSL to encrypt the whole stream.

I can't think of any normal sites that use SSL.  eCommerce sites do, obviously.  And porn sites do, which I suppose is a form of eCommerce.  But it's definitely not common. 

[Mephisto]

Code Select Expand

MD5CALC(MD5CALC(data)+data) = secure md5

[tA-Kane]

Code Select Expand

MD5CALC(MD5CALC(data)+data) = secure md5

Except not. If MD5CALC(Data) == MD5CALC(FalsifiedData), then MD5CALC(MD5CALC(Data)+Data) == MD5CALC(MD5CALC(FalsifiedData)+FalsifiedData) == MD5CALC(MD5CALC(Data)+FalsifiedData) == MD5CALC(MD5CALC(FalsifiedData)+Data)

[Mephisto]

Code Select Expand

MD5CALC(MD5CALC(data)+data) = secure md5

Except not. If MD5CALC(Data) == MD5CALC(FalsifiedData), then MD5CALC(MD5CALC(Data)+Data) == MD5CALC(MD5CALC(FalsifiedData)+FalsifiedData) == MD5CALC(MD5CALC(Data)+FalsifiedData) == MD5CALC(MD5CALC(FalsifiedData)+Data)

[EpicOfTimeWasted]

Code Select Expand

MD5CALC(MD5CALC(data)+data) = secure md5

MD5 is broken... calling it multiple times doesn't make it any less broken.

[Maddox]

How is this the death of MD5?

What this does is generate two sets of data that have the same hash.  You can't generate false data from a given hash using this.

[dxoigmn]

How is this the death of MD5?

What this does is generate two sets of data that have the same hash.  You can't generate false data from a given hash using this.

http://www.schneier.com/essay-074.html

[Maddox]

How is this the death of MD5?

What this does is generate two sets of data that have the same hash.  You can't generate false data from a given hash using this.

http://www.schneier.com/essay-074.html

Ok?

[dxoigmn]

How is this the death of MD5?

What this does is generate two sets of data that have the same hash.  You can't generate false data from a given hash using this.

http://www.schneier.com/essay-074.html

Ok?

Well let me outline the main points:

• One-way hash functions are supposed to have two properties.
• One, they're one-way.
• Two, they're collision-free.
• Breaking a hash function means showing that either -- or both -- of those properties aren't true.

You might argue that mathematically no hash function can be collision free. But that isn't the point. The point is it should be sufficiently difficult to find such a collision. Well no longer is it difficult. "Attacks always get better; they never get worse."

[tA-Kane]

[li]Two, they're collision-free.[/li]

Not so much collision-free (since that'll be pretty much impossible for any source value longer than the length of the hash) as relatively impossible to locate collisions in a timely manner (eg, even a few years is too soon).

[dxoigmn]

[li]Two, they're collision-free.[/li]

Not so much collision-free (since that'll be pretty much impossible for any source value longer than the length of the hash) as relatively impossible to locate collisions in a timely manner (eg, even a few years is too soon).

Yea, I said that in my post...