Security of GPG encryption with AES and MD5 if MD5 is broken

Question

I have a file encrypted with gpg, using AES256 and MD5. Suppose that the MD5 hash function is broken, but not the AES cipher. Does that make it easy to crack decrypt the file?

Answer 1

Depending upon to what extent MD5 is "broken", a break of MD5 might enable chosen-ciphertext attacks. However, as far as I know, it won't enable purely passive eavesdropping.

That said, the likelihood of a catastrophic break of MD5 (bad enough to compromise the secrecy of your gpg-encrypted data) is probably much lower than other risks your system faces. I think it's unlikely that this is the weakest link in your system, or that this is anywhere near the biggest risk in your system. This risk is likely nearly negligible, compared to other kinds of risks that tend to be present in most information systems.

Answer 2

If MD5 is used to create the key that AES uses, then if MD5 is broken, someone else can re-create the key used by AES, and thus be able to decrypt the file.

Not unless MD5 is used with something else, like an iterated key derivation function.

MD5 is considered broken. So I suggest to not use it anymore.