Apparently, for the Android KeyChain an encrypted master key is stored along the MD5 hash of the unencrypted Key. How secure is that? MD5 is known to have collisions, but I guess we can assume with an input space limited to 128bit values no collisions turn up? But still, given that there is no salt involved, isn't it possible for an powerful attacker to calculate rainbow tables and then instantly break every KeyChain an any Android device he gets his hands on?

Why is the plain MD5 hash of the secret key used to check if the Pincode is valid?

  • Do you have a link to whatever documentation you're referencing? Nov 23, 2014 at 18:32

2 Answers 2


Collisions are not useful in this case. You need a pre-image attack that can find the correct input that was used to generate the hash. An alternate input that creates a collision is still not the correct key, and won't decrypt the data. Finding the correct 128-bit random input is not feasible, even with MD5.

  • So this means to get any use out of this, I'd have to store all possible 128bit values and their MD5 values, which is impossible today?
    – Josef
    Nov 26, 2014 at 13:06

Agreed this needs some documents to speak clearly about the subject. Above the fold Google search resulted in http://www.cs.ru.nl/bachelorscripties/2013/Raoul_Estourgie___3022420___Analysis_of_Android_Authenticators.pdf page 30, which describes a pdk type functionality using a random salt. Assuming the research is valid, the usage of md5 in this equation would not be a weak link at all.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .