Can I use Honey Encryption in place of MD5?

Question

The MD5 hashing algorithm is a one-way cryptographic function that accepts a message of any length as input and returns as output a fixed-length digest value to be used for authenticating the original message.The MD5 hash function was originally designed for use as a secure cryptographic hash algorithm for authenticating digital signatures.

Honey Encryption algorithm can give us the functionality of securing the data as well as making us aware of any threats well in time.

Both of these are one kind of encryption technique. So is it possible to use Honey encryption in place of MD5?

Answer 1

No, not directly. The concepts are almost diametrically opposed, so you would need build an entirely new system. But you shouldn't be using MD5 either. For password hashing you should be using a slow hash function with a variable work factor, like bcrypt, and for general cryptographic hashes, a more modern and stronger function such as SHA-2.

Answer 2

Let me guess, you are thinking that a service could use Honey Encryption in place of a salted hash process (not necessarily MD5) to store user passwords and offer an added layer of protection in case of a data breach. If it could work for a single user in their password manager, then it could work for all users of a system.

This is a logic error.

The reason why you want encryption in a password manager, is because you want to recover the data. So, yes, stronger methods of encryption, and even deception techniques, can be a good idea. But this is not as secure has a simple salt and hash process.

You want a hash process because it is stronger than encryption, and this becomes a viable option if you do not need to recover the data, as in a password checking process as part of authentication. The user supplies a password, you hash and salt it, then compare to the stored value in the password database.

So, if you replace hashing with encryption (even if it has deception features), you reduce the strength of the data protection mechanism. Stick with proper hashing in the authentication system, but if this proposed encryption idea works out, use it for your own personal password storage.