Re: CISCO MD5 encryption

[Paul Johnston <paul.johnston () pentest co uk>]

Hi,

> As previously stated - folks are engineering collisions on it. MD5 is
> broken, regardless of who is using it. I'm not even sure it can be
> used as a PRF, But that's not stopping FreeBSD (they also use ARC4,
> which is biased).

What you - or anyone arguing against MD5 in this thread - have not
explained is why we should be concerned about collisions in a hash
function used for password hashing?

The short answer is that we shouldn't be in any serious way. Collisions
affect a hash algorithm when you're using it for digital signatures, or
some other uses. Knowing a whole bunch of MD5 collisions does not help
in any way with reversing a captured MD5 hash.

The only way it matters is on a more philosophical level, that if some
weakness has been found in an algorithm, others are more likely in the
future. But this does not justify a panic switch in technologies, nor
the bandwidth this thread has gotten. (and here's me adding more...)

Paul

-- 
Pentest - When a tick in the box is not enough

Paul Johnston - IT Security Consultant / Tiger SST
Pentest Limited - ISO 9001 (cert 16055) / ISO 27001 (cert 558982)

Office: +44 (0) 161 233 0100
Mobile: +44 (0) 7817 219 072

Email policy: http://www.pentest.co.uk/legal.shtml#emailpolicy
Registered Number: 4217114 England & Wales
Registered Office: 26a The Downs, Altrincham, Cheshire, WA14 2PU, UK

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------