Re: Report of collision-generation with MD5

From: Brett Glass (brett_at_lariat.org)
Date: 08/19/04

  • Next message: Fernando Gleiser: "Re: Report of collision-generation with MD5" 
    Date: Wed, 18 Aug 2004 17:46:48 -0600
To: chris-freebsd@randomcamel.net, freebsd-security@freebsd.org

    At 02:54 PM 8/18/2004, Chris Doherty wrote:

    >what you can do, if you have a proper attack formula, is find *a* message
    >that produces *that one hash*. that is, if I have message M which produces
    >hash H, I can use the attack to find *a* message M' which will also
    >produce hash H.

    The thing is, passwords are short and have limited entropy. Chances are,
    if you find a password that produces the same hash, it's M.

    --Brett

    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: Fernando Gleiser: "Re: Report of collision-generation with MD5"

    Relevant Pages

    • Re: Password hashes
      ... NTLM hash as the key. ... There is however no locally stored NTLMV2 hash of passwords. ... Auditing and reviewing the security logs ... secure their network and data and the documentation to do such at TechNet ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Windows XP / 2K3 Default Users
      ... Cracking the 'passwords' has never been ... The gist of the 'technique' is the "Modifying Windows NT Logon Credential" ... existing windows applications that use the hash currently set to ... and then re-use those hashes to try to get authenticated access to other ...
      (Pen-Test)
    • Re: SQL Storing Passwords?
      ... Subject: SQL Storing Passwords? ... First of all, storing salts next to a hash is not bad design, it ... we examine the importance of Apache-SSL and who needs an SSL ... use a thawte Digital Certificate on your Apache web server. ...
      (Security-Basics)
    • Re: Pidgin IM Client Password Disclosure Vulnerability.
      ... because we need to be able to generate the hash a given ... Some protocols can ask for different types of hashes at ... passwords stored in it ... lost, you have much bigger problems than lost IM passwords. ...
      (Bugtraq)
    • Re: Decrypt fails
      ... I am creating a MD5 hash data and then using it to derive a key ... (CALG_RC2 encryption algorithm). ... My requirement concerns more with not storing passwords in plain ... > that he provided and compare it to the hash in the database. ...
      (microsoft.public.platformsdk.security)