3 ms·
I was talking about collisions within the same hashing algorithm. It might be the case that MD5^2(a) == MD5^2(b) where MD5(a)!= MD5(b), but not the other way ar
by philh 17y ago
I was talking about collisions within the same hashing algorithm. It might be the case that MD5^2(a) == MD5^2(b) where MD5(a)!= MD5(b), but not the other way around. So collisions in MD5^2 will be a superset of collisions in MD5. Iterating thousands of times will further increase the number of collisions.
- tptacek 17y agoYou're suggesting that there are passwords that will generate 20-byte hashes that will themselves collide on the next application of MD5? I'm not sure this has much to do with the security of PBKDF2.
- cperciva 17y agoSo collisions in MD5^2 will be a superset of collisions in MD5. Iterating thousands of times will further increase the number of collisions. This is 100% true, but 99% irrelevant. For any good hash, the number of collisions only increases linearly (proof: if it increased any faster, you would have a fast collision-finding algorithm); so you'd need to iterate your hash an unreasonably large number of times before extra collisions outweighed the benefit of slowing down the attacker. That said: This is exactly why we have PBKDF2. PBKDF1 was just an iterated hash; PBKDF2 was introduced to "reduce concerns about the recursion degenerating into a small set of values".