Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poisonous MD5 – Wolves Among the Sheep

blog.silentsignal.eu

Post reply on HN
Print view View original

41–50 of 55 posts

Re: Poisonous MD5 – Wolves Among the Sheep

#41

Post by crylon »

VLM wrote: post #37
xorcist wrote: post #30

Earlier quoted context omitted.

That is the common wisdom. However some people, most known perhaps djb, actually argue against it. Pluggable algorithms may allow for downgrade attacks, and in a world wide complex system there will always be holdouts for some reason. They argue you would be better with hardcoding your system to known secure best practice. When the time comes to change it, you specify a new protocol version, as there will be new and…

"Pluggable algorithms may allow for downgrade attacks" This is a uniquely severe problem for hashing. MD5 is by far the fastest of the common hashes, at least 20% faster than SHA1 for example. The Venn diagram is you've got popular fast hashes, of which md5 is arguably the best, and in fast hashes, you've got cryptographically secure fast hashes, of which md5 most certainly is no longer a member. Its awesome for ever…

BLAKE2b, an apparently well-regarded derivative of one of the SHA-3 finalists, is faster than even MD5 while retaining security. https://blake2.net/

Re: Poisonous MD5 – Wolves Among the Sheep

#42

Post by __z »

dperfect wrote: post #36
__z wrote: post #34

Earlier quoted context omitted.

>always wondered if it's just a matter of a few years before the "impossible" becomes possible. This is from 1998 but the relevant parts - https://www.schneier.com/essays/archives/1998/05/the_crypto_... >Cryptographic algorithms have a way of degrading over time. It's a situation that most techies aren't used to: Compression algorithms don't compress less as the years go by, and sorting algorithms don't sort slower.…

I suppose one could say this is an argument against using the "computer the size of the universe operating for a trillion trillion years"-type illustrations. Statements like that reflect the current theoretical strength of an algorithm, but unfortunately the illustrations can lead us to (wrongly) assume that flaws won't be discovered in the algorithm for that period of time, which is very much untrue and undermines t…

No arguments from me that cyptography is often explained confusingly which leads to misunderstandings.

Re: Poisonous MD5 – Wolves Among the Sheep

#43

Post by userbinator »

rictic wrote: post #9
dperfect wrote: post #7

Earlier quoted context omitted.

Cool - didn't realize the difference was so great. I've always known that the good algorithms are better because they're more difficult to brute-force, but always wondered if it's just a matter of a few years before the "impossible" becomes possible. Your illustration helps clarify that improbability in my mind - thanks!

MD5 is also supposed to require a tremendous amount of computation, it's just that there are weaknesses in the algorithm that were eventually discovered, such that an attacker can short circuit much of that work. The reason that SHA-1 is being sunset is that some preliminary results by researchers suggest that it also has weaknesses that can enable it to be short circuited, and that researchers appear to be on a path…

The story of how the MD5 collision pathways were discovered is an interesting one - the first colliding pair is said to have been calculated by Xiaoyun Wang by hand, with little computer use. She has also figured out similar methods for SHA-1 and a few other hashes.

http://en.wikipedia.org/wiki/Wang_Xiaoyun

Re: Poisonous MD5 – Wolves Among the Sheep

#44

Post by WalterGR »

The relevance of the article's mention of the "Flame" malware was puzzling, since no context is provided and the linked Wired article doesn't shed any light.

Wikipedia has this to say, which seems to solve that puzzle:

"Flame was signed with a fraudulent certificate purportedly from the Microsoft Enforced Licensing Intermediate PCA certificate authority. The malware authors identified a Microsoft Terminal Server Licensing Service certificate that inadvertently was enabled for code signing and that still used the weak MD5 hashing algorithm, then produced a counterfeit copy of the certificate that they used to sign some components of the malware to make them appear to have originated from Microsoft. A successful collision attack against a certificate was previously demonstrated in 2008, but Flame implemented a new variation of the chosen-prefix collision attack."

http://en.m.wikipedia.org/wiki/Flame_%28malware%29

Re: Poisonous MD5 – Wolves Among the Sheep

#45

Post by bariumbitmap »

Too wrote: post #20
cm2187 wrote: post #19

Earlier quoted context omitted.

But that's a white list. But I thought anti-virus rather work by black listing.

virustotal.com allows you to upload files to scan with a whole range of anti-virus programs. Before uploading, it will calculate the hash of your file client-side to see if the file should be uploaded or if a previously uploaded (by someone else) file with same hash should be re-scanned with newer versions of the anti-virus. I don't know which hashing algorithm they use but just as example of a situation where whitel…

Yes, I think that's what the author was alluding to here, although I'm not sure:

  The approach may work with traditional AV software too as
  many of these also use fingerprinting (not necessarily MD5)
  to avoid wasting resources on scanning the same files over
  and over (although the RC4 encryption results in VT 0/57
  anyway…).

Re: Poisonous MD5 – Wolves Among the Sheep

#46

Post by blutfink »

bluefox wrote: post #28
dperfect wrote: post #25

Earlier quoted context omitted.

I feel like this gets missed in the debate over the "best" hash algorithms. It seems like the message is always "use XYZ algorithm for everything - it's practically perfect and the only one you'll ever need". In reality, it should be more along the lines of "migrate to this one for now, but don't build things that depend on it being the best option next year since it's probably not perfect. Design your systems to eas…

Correct. http://valerieaurora.org/hash.html

The "Reactions" table is hilarious – thanks for the link.

Re: Poisonous MD5 – Wolves Among the Sheep

#47

Post by ryan-c »

taumhn wrote: post #40
ryan-c wrote: post #16

Earlier quoted context omitted.

What you describe there would be a preimage attack[0], not a collision attack. There is no publicly known practical[1] preimage attack on MD5 at this time. 0. http://en.wikipedia.org/wiki/Preimage_attack 1. 2^123.4 complexity is not practical

If I understand correctly, what's described in the article indeed uses a collision attack. The "trusted app" is one the hacker manufactures himself.

Yes, that was what the article says, but the person I was responding to misunderstood.

Re: Poisonous MD5 – Wolves Among the Sheep

#48

Post by aylons »

I'm no security expert, but I have a question.

In some systems I've built in the past I employ MD5 as a hashing mechanism to verify firmware integrity after flashing it in the memory. I don't use MD5 for anything security related (this is treated in other ways, depending on the system), just to check transmission and memory integrity.

Is MD5 still considered fine for this, or is there a real risk that random or systematic (but unintentional) noise could generate a collision between corrupted and original data? I do believe it should suffice, but hearing all the badmouth makes me wonder...

Re: Poisonous MD5 – Wolves Among the Sheep

#49

Post by cmdrfred »

aylons wrote: post #48

I'm no security expert, but I have a question. In some systems I've built in the past I employ MD5 as a hashing mechanism to verify firmware integrity after flashing it in the memory. I don't use MD5 for anything security related (this is treated in other ways, depending on the system), just to check transmission and memory integrity. Is MD5 still considered fine for this, or is there a real risk that random or syste…

I'm no expert either but as I recall if you verify the length as well it should be almost impossible.

Re: Poisonous MD5 – Wolves Among the Sheep

#50

Post by andrew-lucker »

aylons wrote: post #48

I'm no security expert, but I have a question. In some systems I've built in the past I employ MD5 as a hashing mechanism to verify firmware integrity after flashing it in the memory. I don't use MD5 for anything security related (this is treated in other ways, depending on the system), just to check transmission and memory integrity. Is MD5 still considered fine for this, or is there a real risk that random or syste…

MD5 is good enough to prevent most random collisions. The problem is when you need to prevent intentional collisions.
Post reply on HN