MD5 Vulnerability

kareldjag · Jan 19, 2005

Hi,

As i recently posted it on the wish list, more powerfull algorithm than MD5 are preferable for more security (changes files detection).

This recent vulnerability corroborates this:

***By Securiteam:

http://www.securiteam.com/securityreviews/6N00C0KC0Q.html

***By the original Disclaimer:

http://www.doxpara.com/

This vulnerability concerns also all security softwares using the MD5 algorithm(IDS/IPS,anti-virus without signatures, Firewall application using integrity control like SSM, Sandboxes, Firewalls, Data integrity protections, authentification systems and so on).

Best Regards

Pilli · Jan 19, 2005

Hi kareldjag, No immediate danger according to the writers but I am sure DCS, for one, will take any risk into consideration and apply changes as necessary.
From the article:

Yet even now there are those who have hinted that there isn’t any applied risk and that the vulnerabilities are purely theoretical. Outside of FIPS’s unwillingness to certify MD5 there is no apparent push to migrate way from MD5 as we once did for its predecessor,
MD4.
Click to expand...

And:

XI. CONCLUSIONS
The point is not that MD5 has collapsed. It hasn’t. The point is that there’s a very clear trend regarding the security level of MD5, and it isn’t good. It is now undeniable that the selection of MD5 matters – the constraint that deployed implementations of the one-way hash primitive be functionally identical has been broken. The failures detected are not merely algorithmic or theoretical, rather new capabilities above and beyond what the primitive specifies are made available by the selection of MD5. It is not expected that
this paper will cause a precipitous decline in the use of MD5; that will probably occur when a means of silently introducing single-bit errors in arbitrary (rather than chosen) MD5 payloads is discovered. But in the security community, we tend to complain about the ”phase change” nature of our systems that suddenly collapse from secure to insecure on the discovery of a ”zero day” exploit. The phase change for MD5 isn’t here yet, but it will come, someday. Nobody should be surprised when that day arrives.
Click to expand...

Log in or Sign up

MD5 Vulnerability

kareldjag Registered Member

Pilli Registered Member

Log in or Sign up

MD5 Vulnerability

kareldjag Registered Member

Pilli Registered Member

Useful Searches