Beefy Boxes and Bandwidth Generously Provided by pair Networks
Problems? Is your data what you think it is?
 
PerlMonks  

Re^2: MD5 - what's the alternative

by ctilmes (Priest)
on Aug 27, 2004 at 12:05 UTC ( #386334=note: print w/ replies, xml ) Need Help??


in reply to Re: MD5 - what's the alternative
in thread MD5 - what's the alternative

You can also throw some private bits into the data stream before hashing.

If user supplies PW, which gets hashed to PW', and a 3rd party gets PW', the weakness allows them to discover another password that also hashes to PW'.

If you add additional bits to the supplied PW -- PWpri, and hash that to PWpri', which the attacker gets, and using the techniques described, comes up with some bits that also hash to PWpri', they still can't come up with a valid PW that when pri gets added to it also produce PWpri'.

Of course, if your security is such that an attacker can discover PWpri', they can probably find pri out anyway, and you're probably owned at that point anyway, so discovering PW is the least of your concerns.


Comment on Re^2: MD5 - what's the alternative

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://386334]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others romping around the Monastery: (6)
As of 2014-07-12 20:08 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    When choosing user names for websites, I prefer to use:








    Results (241 votes), past polls