5

I was recently viewing a website and saw its certificate info as follows:

enter image description here

Given that MD5 is badly broken and not recommended for hashing, how good is it for use in TLS? And why?

Improve this question
1
  • The fact that you're using MD5 is bad enough for you to get the h#ll out of there. TLS 1.0 is just the cherry on the top. Seriously, so many SSL vulnerabilities have risen on the past few months that everybody should consider any tunnel established weaker than TLS 1.2 with AEAD to be broken.
    – DarkLighting
    Apr 6, 2015 at 22:24

2 Answers 2

Reset to default
8

In TLS, MD5 is used as the compression function for HMAC. The best current security proof for HMAC does not require its compression function to be collision-resistant, so HMAC-MD5 is still considered secure (if distasteful).

TLS 1.0 and RC4 are more disconcerting than MD5 in this case.

Improve this answer
1

That this page is using MD5 is bad. Even SHA-1 wouldn't be nice.
But hashing and authentication are two different things and as far as I can see this site uses HMAC-MD5, which does't need the collision resistance although this would be nice to have. This was already discussed here.

Well, the cipher suite this site is using to connect to you is pretty bad. Three properties you don't want:

  • RC4 has been obsoleted in a recent RFC and some severe attacks have been found recently.
  • MD5 is badly broken, as you already noticed, although this doesn't affect TLS yet.
  • RSA key transport is used, which is known to be massively exploited (broken) by the NSA and not providing no forward secrecy at all.
Improve this answer
5
  • 1
    When you conclude from this presentation that "RSA is massively broken", you either didn't read it or didn't understand it completely. The presentation describes two attacks, one requires to know the private key of the server and the other a buggy version of OpenSSL with a bad RNG which was patched ages ago.
    – Philipp
    Apr 6, 2015 at 23:34
  • Downvoted for RSA FUD. RSA is not broken, if you use appropriate key sizes (>= 2048 bits)
    – Stephen Touset
    Apr 7, 2015 at 0:33
  • with "broken" I meant DHE/ECDHE are way better alternatives and key theft presents a more serious threat to rsa than to DHE. Because of these problems RSA will be dropped in TLS v1.3, so I said "broken". Technically, if you can make sure keys are safe from theft, RSA is unbreakable.
    – SEJPM
    Apr 7, 2015 at 10:59
  • RSA is not being removed from TLS 1.3. Static key exchange with RSA (and DH) is.
    – Stephen Touset
    Apr 7, 2015 at 16:44
  • sorry, I didn't express myself clear. I'm aware of the fact that RSA as signature scheme will be continued and RSA as key-exchange method will be dropped. That's what I meant with "RSA will be dropped in TLS v1.3".
    – SEJPM
    Apr 7, 2015 at 19:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .