Full Disclosure mailing list archives
Re: MD5 algorithm considered toxic (and harmful)
From: Tim <tim-security () sentinelchicken org>
Date: Sat, 1 Dec 2007 14:20:21 -0500
because they perform risk-analysis: - what are the threats to my assets? - which role does MD5 play there? - any subsequent risk then from using it? - high priority risk? mitigating controls or risk acceptance?
Don't kid yourself. Very few businesses in my experience think about this stuff when they go to use a hash. Most just use whatever hash they're used to using. I rarely see clients actually sitting down and thinking about what the application of a given hash is and what the threats are in their specific case.
would you be so kind to show me a real-world attack against a VPN using MD5 hashing? ...
Assuming there are no real-world attacks against your particular VPN that uses MD5, does that make it safe for the rest of us in any given application? A rather leading question IMO. tim _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- MD5 algorithm considered toxic (and harmful) Kristian Erik Hermansen (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) Steven Adair (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) James Matthews (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) Enno Rey (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) Tim (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) Paul Schmehl (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) James Matthews (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) Steven Adair (Dec 01)
- Re: MD5 algorithm considered toxic (and harmful) Kristian Erik Hermansen (Dec 01)