Beefy Boxes and Bandwidth Generously Provided by pair Networks
Syntactic Confectionery Delight

Re^2: MD5 - what's the alternative

by ctilmes (Vicar)
on Aug 27, 2004 at 12:05 UTC ( #386334=note: print w/replies, xml ) Need Help??

in reply to Re: MD5 - what's the alternative
in thread MD5 - what's the alternative

You can also throw some private bits into the data stream before hashing.

If user supplies PW, which gets hashed to PW', and a 3rd party gets PW', the weakness allows them to discover another password that also hashes to PW'.

If you add additional bits to the supplied PW -- PWpri, and hash that to PWpri', which the attacker gets, and using the techniques described, comes up with some bits that also hash to PWpri', they still can't come up with a valid PW that when pri gets added to it also produce PWpri'.

Of course, if your security is such that an attacker can discover PWpri', they can probably find pri out anyway, and you're probably owned at that point anyway, so discovering PW is the least of your concerns.

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://386334]
and all is quiet...

How do I use this? | Other CB clients
Other Users?
Others surveying the Monastery: (9)
As of 2018-06-21 12:51 GMT
Find Nodes?
    Voting Booth?
    Should cpanminus be part of the standard Perl release?

    Results (118 votes). Check out past polls.