Timeline for Is MD5 considered insecure?
Current License: CC BY-SA 3.0
24 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 4, 2017 at 11:47 | comment | added | CodesInChaos | @ivan A salt is stored alongside the password hash and thus known to the attacker. Password hashing is only the last level defense when an attacker has compromised the server all its secrets (including encryption keys used to encrypt the password hash, or pepper). | |
| Oct 4, 2017 at 11:21 | comment | added | ivan | I've seen this reasoning (about speed of md5) a number of times, and while I agree that slower hashing is more secure, I don't understand the practical advice against salting. So, I am salting strings with 20 chars salt, the resulting string is at least 28 chars. Now, an attacker can do billions of hashes per second per GPU, let's say he has millions of GPUs running for an year. What is the chance he will get the original string? I can do math, the probability is practically 0. | |
| Mar 17, 2017 at 10:46 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
| Aug 25, 2015 at 16:51 | vote | accept | Tawfik Khalifeh | ||
| S Jun 18, 2015 at 12:35 | history | suggested | Devin | CC BY-SA 3.0 |
Fixed grammatical error (word ordering)
|
| Jun 18, 2015 at 12:32 | review | Suggested edits | |||
| S Jun 18, 2015 at 12:35 | |||||
| Jun 20, 2013 at 8:45 | comment | added | CodesInChaos | @buherator I don't think SHA-3 is standardized yet. We know that keccak is the winner of the competition, but we don't know which tweaks NIST will apply to it before it becomes SHA-3. Concerning the insecurity of MD5, not every application relies on collision resistance, so not every application needs to urgently migrate away from MD5. For new projects I certainly wouldn't recommend MD5. | |
| Jun 20, 2013 at 8:36 | comment | added | buherator | The authors of the Flame malware managed to generate a chosen-prefix collision in MD5 which is quite scary, I wouldn't recommend this algorithm for any purpose anymore. SHA-3 is standardized by now AFAIK. | |
| Jun 14, 2013 at 18:39 | history | edited | CodesInChaos | CC BY-SA 3.0 |
added 91 characters in body
|
| Oct 29, 2012 at 9:33 | history | edited | CodesInChaos | CC BY-SA 3.0 |
deleted 6 characters in body
|
| Sep 10, 2012 at 20:53 | comment | added | Bradley Kreider | Using GPUs you can get 33.1Billion hashes a second for MD5. 6 char passwords are instantly toast. | |
| Sep 10, 2012 at 10:29 | comment | added | ewanm89 | @sarepta My GPU can handle ~279.5M combinations a second for SHA1 and it's a couple of years old now. I hate to think what a nice shiny new GPU can do for the faster MD5... | |
| Sep 10, 2012 at 10:25 | comment | added | ewanm89 | @drjimbob I didn't say it was feasible yet, though we are getting there, I just pointed out it exists, and that was a full pre-image attack. As others have pointed out, partial pre-image is often good enough. At our current rate with GPU and and FPGA hardware accelerating bruteforce and still getting faster all the time it probably won't be all that long before full pre-image becomes feasible. | |
| Sep 10, 2012 at 9:50 | comment | added | Polynomial | @CodesInChaos Yeah, that's probably a better description. It was about 7am when I wrote that! | |
| Sep 10, 2012 at 9:41 | comment | added | CodesInChaos | @Polynomial I wouldn't call that a partial pre-image. It's rather something like a structured collision. | |
| Sep 10, 2012 at 6:24 | comment | added | dr jimbob | @ewanm89 - 2^123.4 is infeasible (even with billions of GPUs calculating billions of MD5 hashes per second for billions of years). Yes its better than 2^128 by a factor of 24, but the distinction is meaningless for real attacks. (But agree with other reasons to avoid MD5). | |
| Sep 10, 2012 at 6:03 | comment | added | Polynomial | Keep in mind that partial pre-image attacks are possible with MD5. You can take an existing file and alter metadata / append junk and generate a collision against a file you generate entirely. That's how the MD5 SSL certificate collision attack works. | |
| Sep 8, 2012 at 23:05 | comment | added | ewanm89 | A pre-image attack is theoretically possible against MD5, current attacks have a computational complexity of 2^123.4 for full pre-image though. | |
| Sep 8, 2012 at 19:32 | history | edited | CodesInChaos | CC BY-SA 3.0 |
added 39 characters in body
|
| Sep 8, 2012 at 19:26 | history | edited | CodesInChaos | CC BY-SA 3.0 |
added 85 characters in body
|
| Sep 8, 2012 at 19:23 | comment | added | CodesInChaos | @sarepta hashcat is harmless compared to ocl-hashcat which runs on a GPU. A single GPU can to over 6 billion combinations per second with that. | |
| Sep 8, 2012 at 19:20 | vote | accept | Tawfik Khalifeh | ||
| Aug 25, 2015 at 16:50 | |||||
| Sep 8, 2012 at 19:20 | comment | added | Tawfik Khalifeh | the numbers are rather scary, hashcat can try up to [86.24M combination/s] on 8 threads win 7 64bit (md5 hash), it's like a new era of password cracking at the loose. nice answer... | |
| Sep 8, 2012 at 19:10 | history | answered | CodesInChaos | CC BY-SA 3.0 |