5 ms·

That's fine. I will literally give you $10,000 if¹ you can give me a MD5 preimage attack. Take your attack vector to be that particular md5sum that you are maki

That's fine. I will literally give you $10,000 if¹ you can give me a MD5 preimage attack. Take your attack vector to be that particular md5sum that you are making fun of. MD5 is not broken for the usage that you think it's broken for. Please don't snipe on things like this again. People like you who say things like "md5 is always bad" or "you should bcrypt, duh" are literally cargo culting the idea of computer security. In addition to the fundamental technical deficiency you've demonstrated, people who opine on security threads while not quite understanding anything about computer security allow charlatans to sell "computer security". Every single comment like this lends credence to literal scam artists. ¹note, this is actually a prize for a weaker claim than an preimage attack; all I want is a second preimage (!)

lightedman 9y ago
"MD5 is not broken for the usage that you think it's broken for." Correct; it's broken for everything since we've got the computational power to make it essentially ineffective.
- Xylakant 9y ago
  That's not entirely true. It's broken in the sense that for every hash given we can compute an input that produces this hash. Constructing a useful input (in this case a working exploit) is much less trivial. The complexity depends significantly on what the desired input should look like. It's easier for input that have the property that they can ignore chunks of the input (googles PDF example), but still hard for others.
  - megadollar 9y ago
    We cannot produce an input that produces an arbitrary given hash. Here's an easy counterexample: the all-zeroes md5sum. That's an even harder problem than the one I've claimed is entirely not solved. MD5 is still preimage and second-preimage resistant.
technion 9y ago
The other way to look at this is.. MD5 is known to be a poor option. And every few years the practicalities of attacking it increase. And when the type of attack described here does become practical, all we'll be hearing is one side saying "they had ten years to fix this" and another side saying "but experts we consulted said it was fine". It is incredibly easy for whatever process builds a website with an MD5 hash of a download to instead display something else, so the cost trade off becomes: Cost: Virtually nil Mitigation: Currently minimal but has future potential That a company would look at that and say "I guess we'll make a choice to stick with MD5" says something, even if it doesn't say the website downloads are easily compromised. Alternatively, the parent comment could be pointing out that no hash signature that only exists on the download site itself offers value, and they would be better served offering a GPG signature or similar.
stevenh 9y ago
Hello fellow ordinary person using an account created a year ago and finally posting today for the very first time with comically irrational outrage over the possibility of people ever moving away from md5sum thus rendering useless whatever subset of shady tools you or your employer has that we don't know about yet. Consider making innocuous comments in various threads for a few weeks before you switch to psyop mode next time.
- coldtea 9y ago
  Tin foil much? As if what will ...really help NSA and co are 1-2 random comments of technical pedantry regarding MD5 on an insignificant (in the grand scheme of things) forum people go to discuss the latest startup news, JS frameworks, the benefits of functional programming, Golang, tech industry developments, and some CS related news.
  - chillingeffect 9y ago
    Sustained disinformation campaigns are a go-to strategy. Redirecting and confounding conversations are documented tactics. They don't even have to be particularly well veiled or surgically placed as their value derives from their volume.
heinrich5991 9y ago
There are easy collision attacks against MD5. If they used a stronger hash, we would know that they couldn't have been coerced to use a hash that collides with a bad version of the update.
lisper 9y ago
> I will literally give you $10,000 if¹ you can give me a MD5 preimage attack. It's almost certainly a question of when, not if, I will be able to collect on that offer.
benchaney 9y ago
The reason that people move away from a hash function when it looses collision resistance is that collision resistance serves as a measure of the security margin for preimage resistance. Cryptographic primitives are intended to be rotated out of use about 10-15 years before they become actually broken for their intended purpose. Unless you are willing to extend you bounty to the year 2030 it is means nothing. In addition, you are completely wrong about the harm caused by simplifying the rules of thumb for security. There is not good reason to ever use MD5 for this purpose, and saying "MD5 is ok in some cases" has the potentially to do far more harm than "never use MD5". > note, this is actually a prize for a weaker claim than an preimage attack; all I want is a second preimage (!) Don't act like you are doing GP a favor, second preimage is the attack that would cause a vulnerability in this usage of MD5. You are the one who is"opin[ing] on security threads while not quite understanding anything", so I think before the next time you condescendingly correct someone you should make sure you have a basic understanding of what you are talking about.
- megadollar 9y ago
  You're clearly somebody who wants to rely on "rules of thumb" for security. I'm arguing against the entire concept of rules of thumb and you've since argued against a strawman. Did I ever say "MD5 is ok in some cases"? Aside: a preimage attack implies a second preimage attack.
  - benchaney 9y ago
    >You're clearly somebody who wants to rely on "rules of thumb" for security. I'm arguing against the entire concept of rules of thumb Not all devs are security experts, or can even afford to focus on security. To deny the value of rules of thumb is to deny that they need to consider security. > Did I ever say "MD5 is ok in some cases"? Oh, really? Were you not arguing that MD5 is ok if you only need preimage resistance? > MD5 is not broken for the usage that you think it's broken for. Please don't snipe on things like this again. People like you who say things like "md5 is always bad" or "you should bcrypt, duh" are literally cargo culting the idea of computer security. Hmm. Seems like you were...

lightedman 9y ago

"MD5 is not broken for the usage that you think it's broken for." Correct; it's broken for everything since we've got the computational power to make it essentially ineffective.

Xylakant 9y ago
That's not entirely true. It's broken in the sense that for every hash given we can compute an input that produces this hash. Constructing a useful input (in this case a working exploit) is much less trivial. The complexity depends significantly on what the desired input should look like. It's easier for input that have the property that they can ignore chunks of the input (googles PDF example), but still hard for others.
- megadollar 9y ago
  We cannot produce an input that produces an arbitrary given hash. Here's an easy counterexample: the all-zeroes md5sum. That's an even harder problem than the one I've claimed is entirely not solved. MD5 is still preimage and second-preimage resistant.

technion 9y ago

The other way to look at this is.. MD5 is known to be a poor option. And every few years the practicalities of attacking it increase. And when the type of attack described here does become practical, all we'll be hearing is one side saying "they had ten years to fix this" and another side saying "but experts we consulted said it was fine". It is incredibly easy for whatever process builds a website with an MD5 hash of a download to instead display something else, so the cost trade off becomes: Cost: Virtually nil Mitigation: Currently minimal but has future potential That a company would look at that and say "I guess we'll make a choice to stick with MD5" says something, even if it doesn't say the website downloads are easily compromised. Alternatively, the parent comment could be pointing out that no hash signature that only exists on the download site itself offers value, and they would be better served offering a GPG signature or similar.

stevenh 9y ago

Hello fellow ordinary person using an account created a year ago and finally posting today for the very first time with comically irrational outrage over the possibility of people ever moving away from md5sum thus rendering useless whatever subset of shady tools you or your employer has that we don't know about yet. Consider making innocuous comments in various threads for a few weeks before you switch to psyop mode next time.

coldtea 9y ago
Tin foil much? As if what will ...really help NSA and co are 1-2 random comments of technical pedantry regarding MD5 on an insignificant (in the grand scheme of things) forum people go to discuss the latest startup news, JS frameworks, the benefits of functional programming, Golang, tech industry developments, and some CS related news.
- chillingeffect 9y ago
  Sustained disinformation campaigns are a go-to strategy. Redirecting and confounding conversations are documented tactics. They don't even have to be particularly well veiled or surgically placed as their value derives from their volume.

heinrich5991 9y ago

There are easy collision attacks against MD5. If they used a stronger hash, we would know that they couldn't have been coerced to use a hash that collides with a bad version of the update.

lisper 9y ago

> I will literally give you $10,000 if¹ you can give me a MD5 preimage attack. It's almost certainly a question of when, not if, I will be able to collect on that offer.

benchaney 9y ago

The reason that people move away from a hash function when it looses collision resistance is that collision resistance serves as a measure of the security margin for preimage resistance. Cryptographic primitives are intended to be rotated out of use about 10-15 years before they become actually broken for their intended purpose. Unless you are willing to extend you bounty to the year 2030 it is means nothing. In addition, you are completely wrong about the harm caused by simplifying the rules of thumb for security. There is not good reason to ever use MD5 for this purpose, and saying "MD5 is ok in some cases" has the potentially to do far more harm than "never use MD5". > note, this is actually a prize for a weaker claim than an preimage attack; all I want is a second preimage (!) Don't act like you are doing GP a favor, second preimage is the attack that would cause a vulnerability in this usage of MD5. You are the one who is"opin[ing] on security threads while not quite understanding anything", so I think before the next time you condescendingly correct someone you should make sure you have a basic understanding of what you are talking about.

megadollar 9y ago
You're clearly somebody who wants to rely on "rules of thumb" for security. I'm arguing against the entire concept of rules of thumb and you've since argued against a strawman. Did I ever say "MD5 is ok in some cases"? Aside: a preimage attack implies a second preimage attack.
- benchaney 9y ago
  >You're clearly somebody who wants to rely on "rules of thumb" for security. I'm arguing against the entire concept of rules of thumb Not all devs are security experts, or can even afford to focus on security. To deny the value of rules of thumb is to deny that they need to consider security. > Did I ever say "MD5 is ok in some cases"? Oh, really? Were you not arguing that MD5 is ok if you only need preimage resistance? > MD5 is not broken for the usage that you think it's broken for. Please don't snipe on things like this again. People like you who say things like "md5 is always bad" or "you should bcrypt, duh" are literally cargo culting the idea of computer security. Hmm. Seems like you were...