4 ms·
You can only rehash if you have the plaintext password There are techniques to rehash, even without the plain-text password, and without the user having to log
by manarth 10y ago
You can only rehash if you have the plaintext password
There are techniques to rehash, even without the plain-text password, and without the user having to login to trigger a rehash.
Drupal 7 used such a technique for upgrades from Drupal 6, migrating from MD5 to a salted sha512 hash, but it's not an uncommon technique.
The old passwords are stored as MD5 hashes in the databases. The MD5 hash is processed through the same techniques as new passwords: a salt and the new sha512 hash. Provide a way to identify whether the origin was a password, or an MD5 hash.
Either way, you end up with a hash. You can identify whether the origin was a password, or an MD5 hash, but you can neither determine the origin MD5 hash, nor the origin password, as the new hash is secure. So even if the original MD5 hash was insecure, the new hash is secure.
When someone attempts to login, you still need to determine which password-validation to use: hash = sha512(salt + password), or hash = sha512(salt + MD5(password)), but the security level is the same.
- rev_bird 10y agoI was doing all kinds of mental gymnastics trying to figure out how this would work; thanks for explaining it so clearly.
- leereeves 10y ago> hash = sha512(salt + MD5(password)) Passing the password through MD5 reduces the complexity to 128 bits, you can't get that back. So the security level is not the same, though it may be resistant to some attacks on MD5. And it's probably not important for most people, since there are less than 2^56 eight character ASCII passwords.
- manarth 10y ago> "Passing the password through MD5 reduces the complexity to 128 bits, you can't get that back." Assuming that the new hash is secure (and sha512 is generally agreed to be secure), then, given a specific sha512 hash, the original MD5 hash can only be determined via rainbow tables, which is a Big-O operation. Even though entropy is reduced, it's still a significant work to determine the original MD5 hash (significant in this instance being longer than the heat-death of the Sun, given current extrapolations of computing performance). Attacks against MD5 are based around knowing the original MD5 hash. In this instance, the original MD5 hash is unknown, so there is no mathematical shortcut to finding a collision.
- leereeves 10y agoIn this case an attacker isn't looking for a collision (which would mean creating two passwords with the same hash, and what hash that is doesn't matter). The attacker needs a password with a specific hash, and the best reported attack for that is around 2^128.
- manarth 10y agoAgreed, that the best reported rainbow-table attack on MD5 is 2^128 (i.e. the complete range of possible MD5 hashes). Personally, I'm willing to chance that my password will be discovered via a brute-force attack within the next 0.65 billion billion years [1] [1] http://bitcoin.stackexchange.com/questions/2847/how-long-would-it-take-a-large-computer-to-crack-a-private-key http://bitcoin.stackexchange.com/questions/2847/how-long-wou...
- leereeves 10y agoI think it does make sense to be cautious. A new preimage attack could be discovered - or might already have been, secretly.
- danielweber 10y ago> Passing the password through MD5 reduces the complexity to 128 bits No, this is not the problem with MD5. You are not going to find two user-memorizeable-and-typeable passwords with an MD5 collision. If you are bringing a password with more than 128 bits of complexity to the party, any password storage scheme better than plaintext will have your password safe.
- leereeves 10y agoFor passwords, there is no known problem with MD5, unless you know about a preimage attack. Collisions are a problem for digital signatures, not for passwords. But some people do want and use more than 2^128 bit passwords, for whatever reason, and an MD5 intermediate stage limits that.