Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poisonous MD5 – Wolves Among the Sheep

blog.silentsignal.eu

Post reply on HN
Print view View original

51–55 of 55 posts

Re: Poisonous MD5 – Wolves Among the Sheep

#51

Post by innocenat »

andrew-lucker wrote: post #50
aylons wrote: post #48

I'm no security expert, but I have a question. In some systems I've built in the past I employ MD5 as a hashing mechanism to verify firmware integrity after flashing it in the memory. I don't use MD5 for anything security related (this is treated in other ways, depending on the system), just to check transmission and memory integrity. Is MD5 still considered fine for this, or is there a real risk that random or syste…

MD5 is good enough to prevent most random collisions. The problem is when you need to prevent intentional collisions.

As a note, even CRC32 is enough to check most random collisions.

Re: Poisonous MD5 – Wolves Among the Sheep

#52

Post by aylons »

innocenat wrote: post #51
andrew-lucker wrote: post #50

Earlier quoted context omitted.

MD5 is good enough to prevent most random collisions. The problem is when you need to prevent intentional collisions.

As a note, even CRC32 is enough to check most random collisions.

I actually thought of using CRC32 when developing my first system, but I preferred MD5 because it would be easier and clearer for people to check file integrity in a *NIX command line.

Re: Poisonous MD5 – Wolves Among the Sheep

#53

Post by leni536 »

VLM wrote: post #37
xorcist wrote: post #30

Earlier quoted context omitted.

That is the common wisdom. However some people, most known perhaps djb, actually argue against it. Pluggable algorithms may allow for downgrade attacks, and in a world wide complex system there will always be holdouts for some reason. They argue you would be better with hardcoding your system to known secure best practice. When the time comes to change it, you specify a new protocol version, as there will be new and…

"Pluggable algorithms may allow for downgrade attacks" This is a uniquely severe problem for hashing. MD5 is by far the fastest of the common hashes, at least 20% faster than SHA1 for example. The Venn diagram is you've got popular fast hashes, of which md5 is arguably the best, and in fast hashes, you've got cryptographically secure fast hashes, of which md5 most certainly is no longer a member. Its awesome for ever…

> but I can trust my own coworkers

I'm sure that you trust them, but do you trust their computers? Do you trust all of them that they can keep their personal computers and their accounts secure?

Maybe it doesn't match your case perfectly, but in general trusting people and trusting people's accounts is not the same thing.

Re: Poisonous MD5 – Wolves Among the Sheep

#54

Post by WalterGR »

WalterGR wrote: post #44

The relevance of the article's mention of the "Flame" malware was puzzling, since no context is provided and the linked Wired article doesn't shed any light. Wikipedia has this to say, which seems to solve that puzzle: "Flame was signed with a fraudulent certificate purportedly from the Microsoft Enforced Licensing Intermediate PCA certificate authority. The malware authors identified a Microsoft Terminal Server Lice…

Whoops - I didn't remember that Wikipedia uses a separate domain for mobile browsers.

Here's the 'real' link: http://en.wikipedia.org/wiki/Flame_%28malware%29

Re: Poisonous MD5 – Wolves Among the Sheep

#55

Post by makomk »

This is actually one of the older and easier attacks against MD5; we've known this was possible for over a decade. Nowadays it's actually possible to so chosen prefix attacks - you can literally take two arbitrary, unrelated files and append some data that makes them have the same MD5. So you don't even have to include the malicious code in the decoy file in any form anymore.
Post reply on HN