If they were to break in to the system and download the hashed password file, they could, with difficulty, find passwords that would work.
While nobody has been able to turn the output of the MD5 hash into the original text. The bad news is MD5 does not take very much CPU time.
“Wait, is that bad news?” Actually, it is. When calculating hash values, you want to take more CPU time, rather than less. The faster the bad guys can test millions and billions of passwords, the quicker they can arrive at the one you are trying to keep secret.
I ran a test of five million nine character passwords and got the following results on my machine (using openssl, results in milliseconds):
- MD5 : 2449
- SHA1 : 2620
- SHA256: 3884
If they want to test about 5 billion passwords, which would cover almost all the possible six character passwords, the CPU time would range from about 28 days for MD5 to 44 days for SHA256. This is with a single thread on a not very fast computer. If they invested a few hundred dollars for half a dozen graphics cards, this could be done in hours.
It is common for the hashing process to calculate the hash multiple times. We would calculate the hash of the password "abc123" and get “8be8efb0bfa…” If we then calculate the hash of the hash, we will get “98dead38ed2…”. You can see that if we do this ten or 100 times, we will hardly notice the difference in the time but the bad guys will have to take not hours but days or months.
Don’t forget, you only need to find a string that hashes to the value stored in the password table, not necessarily the original value. Any collision will do. There are ways of attacking the hash itself to find collisions that may be simpler that this brute force attack. For what it is worth, I doubt there are very many pairs of printable character strings that hash to the same value.
I am not sure this exactly answers your question but it seems relevant.