4 ms·
I know this is just a comment on HN, but I want to point out that MD5 is not a password hashing function, and is broken even for a number of other hash purposes
by noodlesUK 6y ago
I know this is just a comment on HN, but I want to point out that MD5 is not a password hashing function, and is broken even for a number of other hash purposes. For passwords something like argon2id or another modern slow hashing function is appropriate, and for general purpose, SHA2 and SHA3, as well as BLAKE2 (and maybe BLAKE3) would be good choices.
Further, there’s so little reason not to salt, so you ought to do it. It’s built in to the hash strings in most modern pw hashes. Peppers are also a great idea. Defence in depth!
- sillysaurusx 6y agoMD5 is broken, but HMAC-MD5 is still impossible to break afaik. And md5(pepper + md5(pw)) is basically HMAC. Not commenting on the overall idea, just pointing out that the criticism of md5 happens not to be valid in this case. I was surprised too.
- hatsunearu 6y agoThe discussion of "MD5 collision resistance is bad, but md5 preimage resistance is still ok, so using md5 for applications where preimage resistance is required is ok" is I think completely valid (however pointless it is) However for password hash functions to be useful they also need to have a high work factor to make brute forcing even more difficult.