Re: [ANN] MD5 1.0.2 Released (OT)

[Gé Weijers <ge@...>]

I have an application that requires full collision resistance, which is why I have implemented SHA-256.

The following article claims collision attacks on MD5 within a minute on consumer-grade (read: script-kiddie-grade) computers:

http://eprint.iacr.org/2006/105

I have not verified the claims, but I have no reason to doubt them. So my original claim was off, it now takes only seconds to perform a collision attack on MD5. This just does not give me the "warm fuzzies" about using MD5 in any new cryptographic application.

Gé

On May 9, 2007, at 7:37 AM, Richter, Jörg wrote:

MD5 is not as bad as this may sound. 

For an overview of what exactly is vulnerable and what not see here:

http://www.cryptography.com/cnews/hash.html

   Joerg

For those who have not kept track of developments in 

cryptography lately:

The MD5 and SHA1 algorithms are both vulnerable to collision 

attacks faster than brute force, in the case of MD5 the attack 

only takes hours on a desktop machine. A collision attack is 

an attack that finds strings a, b where a ~= b but hash(a) == hash(b). 

This may or may not be a problem depending on what you use 

these algorithms for, and how you use them. If you are 

digitally signing strings provided by others it is a problem, 

because your signature matches more than one string.

--

Gé Weijers

ge@weijers.org