0

I have an old system that can do PBKDF2 with HMAC using MD5, but not SHA-2. Now I know that MD5 is insecure and shouldn't be used for new applications, but https://crypto.stackexchange.com/a/9340/7075 seems to indicate that HMAC-MD5 is still secure. If I use a strong password, and PBKDF2 with a reasonable number of iterations and a random salt, can an attacker that gets the salted hash reverse-engineer the password?

2
  • Yes, it is secure. The attack on MD5 is an imminent collision attack ( see korkami MD5 ) that has no relation to passwords. Also, HMAC doesn't carry the current weakness of MD5. Still migrate if possible
    – kelalaka
    Sep 8, 2021 at 21:04
  • HMAC with MD5 or SHA-1 is secure when used as a MAC or in a KDF like this, but it is not always secure. For example, HMAC-MD5 is insecure when used as a commitment scheme. That's why it's better to avoid weak algorithms whenever possible, because in many cases, it requires a lot of cryptographic knowledge to know when they're secure.
    – bk2204
    Sep 10, 2021 at 0:54

1 Answer 1

2

Within the limitations of PBKDF2 in general, yes, HMAC-MD5 is still secure. The attacks on MD5 concern collisions, which are fatal for signatures but basically irrelevant for an iterated password, and HMAC also mitigates the risk. You may need a higher iteration count for MD5 than for newer hash functions, because it's a faster algorithm in most implementations (you should aim for work factor that requires a certain amount of time - generally as much time as you can afford - and increase it as hardware gets faster and/or implementations get better).

With that said, it's a good idea to move away from MD5 if possible. Even SHA1 is some amount better, if you can't do SHA2. If nothing else, MD5 is going to set off alarms on code scanning tools, and may mislead a developer into thinking it's safe to use it elsewhere. SHA1 has those problems too, but it's at least slightly less vulnerable than MD5. I recommend also clearly documenting the exception to the usual policy of not using deprecated hash functions.

On the other hand, if possible, you should move to something better than PBKDF2 at all. PBKDF2's only tunable factor is iteration count, and it is extremely parallelizable. All newer password hashing functions deliberately require non-trivial memory as well, which makes parallelization harder. Bcrypt is probably the most popular, but its fixed memory requirement is perhaps insufficient to provide strong protection today. Scrypt and argon2 allow tuning the memory cost, as well as the CPU cost. Argon2 in particular is the winner of large contest to develop a modern password hashing algorithm, and its argon2id variant is considered the state of the art and commonly used in new systems (as of this writing, Sep 2021).

Obviously an old system isn't going to support argon2 - and quite possibly doesn't support bcrypt - but this may be an added incentive to upgrade to a newer system.

1
  • Unfortunately, this system only supports pbkdf2 with md5. In the interest of not rolling my own crypto, I'm trying to work with the vendor-provided functions. Sep 9, 2021 at 0:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .