MD5 To Be Considered Harmful Someday

Effugas writes "I've completed an applied security analysis (pdf) of MD5 given Xiaoyun Wang et al's collision attack (covered here and here). From an applied perspective, the attack itself is pretty limited -- essentially, we can create 'doppelganger' blocks (my term) anywhere inside a file that may be swapped out, one for another, without altering the final MD5 hash. This lets us create any number of binary-inequal files with the same md5sum. But MD5 uses an appendable cascade construction -- in other words, if you happen to find yourself with two files that MD5 to the same hash, an arbitrary payload can be applied to both files and they'll still have the same hash. Wang released the two files needed (but not the collision finder itself). A tool, Stripwire, demonstrates the use of colliding datasets to create two executable packages with wildly different behavior but the same MD5 hash. The faults discovered are problematic but not yet fatal; developers (particularly of P2P software) who claim they'd like advance notice that their systems will fail should take note."

Comments

Re:damn

[somethinghollow]

I am / was redesigning my website, with a database overhaul. A friend of mine convinced me to store passwords in the database w/ some sort of encryption. I'd had experience with the MD5 hashes somehow matching, so I looked for an alternative method. SHA-1 was it.

PHP has the built-in function but my server doesn't support it. Instead I used another implementation: http://www.tecknik.net/sha-1/

I thought there was even a JavaScript implementation somewhere, though I can't seem to find it.

SHA-1, if nothing else, is cooler because it's more fun to say. "Em dee five" versus "Sha, One" which is alot like "Sha, right!" from Wayne's World.