Magnus Hagander wrote:
> Using MD5 for passwords doesn't, afaik, actually require
> collision-resistance. It requires resistance against preimage-attacks,
> which there are none for MD5. At least not yet.
Marc Stevens et al have a chosen prefix attack on MD5 (similar to a
second preimage attack, but slightly weaker) which they've successfully
used to forge root CA certs, using a cluster of PS3s. Cf. their
presentation at 25c3 last December.
>> this has implications for storing passwords as MD5 hashes. My
>>
>
> That would be the only system use of MD5. What implications are those?
>
> We might want to consider using a safer hash for the password storage at
> some point, but from what I gather it's not really urgent for *that* use.
>
It would be a lot more urgent if we weren't salting, but IIRC we are.
Cheers,
--mlp