Kiss md5 good bye

[GreyGeek]

http://www.zdnet.com/blog/security/m...ger-safe/12317

Danish developer Poul-Henning Kamp, who developed the widely used MD5 password scrambler, said that limitations to his software and a corresponding increase in computing power since its initial release has rendered his algorithm obsolete.

“I implore everybody to migrate to a stronger password scrambler without undue delay,” he wrote in a blog post.

[SecretCode]

Interesting. I didn't know md5 was still regarded as reasonable encryption (for short texts like passwords) by anyone any more - just as a signature for long texts / large files, as in verifying integrity of downloaded ISOs.

I don't see anything in the article about this, but I presume it's still hard to create a 700MB file with malware in that would match a given MD5?

[SteveRiley]

For verifying the integrity of known payloads, MD5 remains useful. But for validing secrets, md5crypt is too risky.

[SecretCode]

Are you confirming that an md5sum is tantamount to a proof that an iso download has not been tampered with? i.e. that it's still computationally infeasible to construct a file with
(a) some predefined contents not in the original (malware code somewhere in it, and valid overall structure so it can be burnt / unzipped and booted; possibly with large amounts of arbitrary garbage),
plus (b) a predefined md5sum?

[SteveRiley]

The problem with md5crypt is that computers have become too fast at computing hashes. The inventor himself claims that using md5crypt to generate password hashes simply doesn't provide sufficiently strong protection to guard against brute-force attacks. A bad guy can quickly generate hashes of zillions of common passwords and then attempt basic pass-the-hash attacks.

But as an integrity validating function, like checking a downloaded file, md5sum remains totally useful.