Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a file encrypted with gpg, using AES256 and MD5. Suppose that the MD5 hash function is broken, but not the AES cipher. Does that make it easy to crack decrypt the file?

share|improve this question
Could you provide more details, like which cipher did you used. Are you sure your talking about hash, not key? – Cyril N. May 12 '12 at 9:49
What is the hash use for? Signing? – Christopher Creutzig May 12 '12 at 10:37
lets say thats there is a file encrypted by gpg used AES256 and MD5 ... if MD5 cracked will the file decrypted easily or not – rezx May 12 '12 at 10:57
up vote 2 down vote accepted

Depending upon to what extent MD5 is "broken", a break of MD5 might enable chosen-ciphertext attacks. However, as far as I know, it won't enable purely passive eavesdropping.

That said, the likelihood of a catastrophic break of MD5 (bad enough to compromise the secrecy of your gpg-encrypted data) is probably much lower than other risks your system faces. I think it's unlikely that this is the weakest link in your system, or that this is anywhere near the biggest risk in your system. This risk is likely nearly negligible, compared to other kinds of risks that tend to be present in most information systems.

share|improve this answer
yap got it thanks :) – rezx May 14 '12 at 11:38

If MD5 is used to create the key that AES uses, then if MD5 is broken, someone else can re-create the key used by AES, and thus be able to decrypt the file.

Not unless MD5 is used with something else, like an iterated key derivation function.

MD5 is considered broken. So I suggest to not use it anymore.

share|improve this answer
side question, did hash store my key in the encrypted file, is this the header. – rezx May 22 '12 at 16:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.