hi all, I just had a question. so I have been hearing that md5 has been compromised, how much of a security threat does this impose? if it is something that poses a large concern is it possible to change the encryption method from md5 to crypt? or another method that is not compromised?
thanks
-dustink
On 28.08.2014, dustin kempter wrote:
hi all, I just had a question. so I have been hearing that md5 has been compromised, how much of a security threat does this impose?
MD5 is not used for encryption. See http://en.wikipedia.org/wiki/MD5 for further details and for what md5 actually is.
Note my day job IS data communications and security. I am NOT a cryptographer. I am in a different select group that often refer to ourselves as the crypto-plumbers. We know how to carefully use the crypto blocks to build whole systems.
On 08/28/2014 11:34 AM, dustin kempter wrote:
hi all, I just had a question. so I have been hearing that md5 has been compromised, how much of a security threat does this impose? if it is something that poses a large concern is it possible to change the encryption method from md5 to crypt? or another method that is not compromised?
md5 is a message digest / hash. It is an earlier effort by Ron Rivest. It was paired with Ron's rc5 streaming encryption cipher, but lived by itself as one of the major hash functions in 90s (md5, md160 (do I have that right :) ), and sha1). All have been weakened to different levels. md5 has real attacks where with crafted change to a message you can still get the same hash value.
Today you might STILL use sha1; it has had tremendous resiliency. NIST was expecting it to fall as badly as md5 by this point. Most use at least sha256, and sha3 is now out there. Choose your poison.
data confidentiality is another subject.
Hope this helps.
On Thu, Aug 28, 2014 at 15:29:58 -0400, Robert Moskowitz rgm@htt-consult.com wrote:
Today you might STILL use sha1; it has had tremendous resiliency. NIST was expecting it to fall as badly as md5 by this point. Most use at least sha256, and sha3 is now out there. Choose your poison.
sha3 isn't really ready yet (unless something changed within the last couple of months). The algorithm was chosen a while ago, but there are parameters that need to be chosen and as yet there isn't a standard sha3.
On 08/28/2014 04:47 PM, Bruno Wolff III wrote:
On Thu, Aug 28, 2014 at 15:29:58 -0400, Robert Moskowitz rgm@htt-consult.com wrote:
Today you might STILL use sha1; it has had tremendous resiliency. NIST was expecting it to fall as badly as md5 by this point. Most use at least sha256, and sha3 is now out there. Choose your poison.
sha3 isn't really ready yet (unless something changed within the last couple of months). The algorithm was chosen a while ago, but there are parameters that need to be chosen and as yet there isn't a standard sha3.
yeah. It is out there. Somewhere.
I tend to use sha256sum to check file integrity and then as far into gpg (see: https://www.gnupg.org/ ) as is practical in the situation.
On Thu, Aug 28, 2014 at 2:49 PM, Robert Moskowitz rgm@htt-consult.com wrote:
On 08/28/2014 04:47 PM, Bruno Wolff III wrote:
On Thu, Aug 28, 2014 at 15:29:58 -0400, Robert Moskowitz rgm@htt-consult.com wrote:
Today you might STILL use sha1; it has had tremendous resiliency. NIST was expecting it to fall as badly as md5 by this point. Most use at least sha256, and sha3 is now out there. Choose your poison.
sha3 isn't really ready yet (unless something changed within the last couple of months). The algorithm was chosen a while ago, but there are parameters that need to be chosen and as yet there isn't a standard sha3.
yeah. It is out there. Somewhere.
-- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
-
Bruno Wolff III -
Dustin Kempter -
Heinz Diehl -
Robert Moskowitz -
Tod Merley