Schneier on Security: MD5 and SHA-1 Still Used in 2018

guest · Dec 24, 2018

MD5 and SHA-1 Still Used in 2018
December 24, 2018
https://www.schneier.com/blog/archives/2018/12/md5_and_sha-1_s.html

Last week, the Scientific Working Group on Digital Evidence published a draft document -- "SWGDE Position on the Use of MD5 and SHA1 Hash Algorithms in Digital and Multimedia Forensics" -- where it accepts the use of MD5 and SHA-1 in digital forensics applications:

While SWGDE promotes the adoption of SHA2 and SHA3 by vendors and practitioners, the MD5 and SHA1 algorithms remain acceptable for integrity verification and file identification applications in digital forensics. Because of known limitations of the MD5 and SHA1 algorithms, only SHA2 and SHA3 are appropriate for digital signatures and other security applications.

This is technically correct: the current state of cryptanalysis against MD5 and SHA-1 allows for collisions, but not for pre-images. Still, it's really bad form to accept these algorithms for any purpose. I'm sure the group is dealing with legacy applications, but I would like it to really push those application vendors to update their hash functions.
Click to expand...

"SWGDE Position on the Use of MD5 and SHA1 Hash Algorithms in Digital and Multimedia Forensics" (PDF):
https://www.swgde.org/documents/Released%20For%20Public%20Comment/SWGDE%20Position%20on%20the%20Use%20of%20MD5%20and%20SHA1%20Hash%20Algorithms%20in%20Digital%20and%20Multimedia%20Forensics

Log in or Sign up

Schneier on Security: MD5 and SHA-1 Still Used in 2018

guest Guest

Log in or Sign up

Schneier on Security: MD5 and SHA-1 Still Used in 2018

guest Guest

Useful Searches