3 ms·

I didn't downvote you, but this use case of MD5 is fine - you want to verify whether the binary matches the one they have. You could spend a few hundred bucks o

I didn't downvote you, but this use case of MD5 is fine - you want to verify whether the binary matches the one they have. You could spend a few hundred bucks on AWS to have a binary which matches that as well, but what would be the point - have users delete it? Now, if you used it to verify whether a binary was _secure_, this would be problem. But in this case, the (still unlikely) possibility of a false positive is not really a threat.

gruez 6y ago
>Now, if you used it to verify whether a binary was _secure_, this would be problem Even that's probably fine. Collision attacks require the attacker to control both inputs. In the case of code signing this would mean the publisher is in on it, in which case you're already screwed.
- Sebb767 6y ago
  > Collision attacks require the attacker to control both inputs. Technically, no. It gets a lot easier when you only need to find any pair of inputs which produce a collision, but with computing power increasing a lot and md5 being very broken, it is feasible that a determined attacker with a lot of compute power can create a collision with a fixed hash, or at least will be able to in the somewhat near future. I'd agree that you're reasonably secure, but when you need security, you shouldn't bother with outdated tech when secure and future-proof alternatives are readily available.
  - gruez 6y ago
    >it is feasible that a determined attacker with a lot of compute power can create a collision with a fixed hash That's a preimage attack, which is a much higher bar. Even for md5 there hasn't been much progress made: https://en.wikipedia.org/wiki/MD5#Preimage_vulnerability https://en.wikipedia.org/wiki/MD5#Preimage_vulnerability
    - Sebb767 6y ago
      The referenced paper is from 2009 and points out a complexity of 2^123 (or roughly 10^27). Bitcoin miners currently put out ~150 EH/s, so about 10^17. Only judged by the rounds, double-sha256 (Bitcoin) has 128 and md5 has 4, so let's assume they'd do 10^18 hashes per second on md5. So it would take them about 31 years to find a collision. If the NSA found a way to get the complexity down a bit more (they had a decade) and the target is valuable enough (imagine, for example, having a "valid" TrueCrypt executable), this is not in the realm of impossible anymore. Now, of course, the NSA will probably not outcompute the Bitcoin blockchain and transfering the hash rate is not that simple, but they do have a lot of power and cryptographers. What I'm trying to say is that the orders of magnitude are not in the "totally impossible" space anymore. Yes, you're probably safe, but given the availability of secure alternatives, there's really no reason not to get off the thin ice.
0x1DEADCA0 6y ago
Why spend a few hundred bucks on amazon when you could just wait a few days for your laptop to do the same ^.^

gruez 6y ago

>Now, if you used it to verify whether a binary was _secure_, this would be problem Even that's probably fine. Collision attacks require the attacker to control both inputs. In the case of code signing this would mean the publisher is in on it, in which case you're already screwed.

Sebb767 6y ago
> Collision attacks require the attacker to control both inputs. Technically, no. It gets a lot easier when you only need to find any pair of inputs which produce a collision, but with computing power increasing a lot and md5 being very broken, it is feasible that a determined attacker with a lot of compute power can create a collision with a fixed hash, or at least will be able to in the somewhat near future. I'd agree that you're reasonably secure, but when you need security, you shouldn't bother with outdated tech when secure and future-proof alternatives are readily available.
- gruez 6y ago
  >it is feasible that a determined attacker with a lot of compute power can create a collision with a fixed hash That's a preimage attack, which is a much higher bar. Even for md5 there hasn't been much progress made: https://en.wikipedia.org/wiki/MD5#Preimage_vulnerability https://en.wikipedia.org/wiki/MD5#Preimage_vulnerability
  - Sebb767 6y ago
    The referenced paper is from 2009 and points out a complexity of 2^123 (or roughly 10^27). Bitcoin miners currently put out ~150 EH/s, so about 10^17. Only judged by the rounds, double-sha256 (Bitcoin) has 128 and md5 has 4, so let's assume they'd do 10^18 hashes per second on md5. So it would take them about 31 years to find a collision. If the NSA found a way to get the complexity down a bit more (they had a decade) and the target is valuable enough (imagine, for example, having a "valid" TrueCrypt executable), this is not in the realm of impossible anymore. Now, of course, the NSA will probably not outcompute the Bitcoin blockchain and transfering the hash rate is not that simple, but they do have a lot of power and cryptographers. What I'm trying to say is that the orders of magnitude are not in the "totally impossible" space anymore. Yes, you're probably safe, but given the availability of secure alternatives, there's really no reason not to get off the thin ice.

0x1DEADCA0 6y ago

Why spend a few hundred bucks on amazon when you could just wait a few days for your laptop to do the same ^.^