4 ms·
Perhaps I should have written it as "unsalted MD5" instead of "plain MD5" to avoid confusion. Unsalted MD5, in my opinion, is horrible. MD5 plays it's part in t
by aparadja 15y ago
Perhaps I should have written it as "unsalted MD5" instead of "plain MD5" to avoid confusion. Unsalted MD5, in my opinion, is horrible. MD5 plays it's part in the mess: it's quick to calculate, which means that anybody can churn out huge lookup databases. Missing salts make those databases universally usable.
- TillE 15y ago> huge lookup databases "Huge" being the key word here. Try searching for the md5sums of arbitrary 8-character alphanumeric passwords. You won't find many results. 62^8 is a big number.
- aparadja 15y agoCovering the whole solution space would be an enormous (as compared to just huge) undertaking. But if you limit yourself to the types of passwords people usually use, you can prune it down quite a bit. The currently available databases are surprisingly large, even if not in the scale of 62^8. Consider a random pick from decrypt.fr: "phytostrote972". It's far from a random string, but not exactly a trivial one either.
- Freaky 15y ago> Covering the whole solution space would be an enormous (as compared to just huge) undertaking A HD 5870 can churn through MD5s at about 2.8 billion/sec - 62^8 inside 24 hours on a single unremarkable GPU.
- mattmanser 15y agoYou can download rainbow tables as torrents. 8-character alphanumeric are the ones that are being offered today, it's only going to go up as GPUs get better and HD space/bandwidth increases.
- nobody3141592 15y agoI believe that with GPUs it's now faster to calculate possible MD5s on-the-fly than use rainbow tables. Hence the current advice is to use "alongpassphraseasyourpassword" rather than "L33$Pa55wd"
- FuzzyDunlop 15y agoThis is where password management gets ridiculous, because you'll find a lot of registration forms limit the length of your password input to, say, 12 or 16 characters. Why? Is it not being hashed? I have a (possibly very wrong) inkling that a longer phrase might increase the chance of collision but even so, so many places enforce a strong password but force you to keep it short.
- nobody3141592 15y agoThe worst offender is NVidia. They have half-a-dozen different developer logins for different bits of their site - and they all have different rules = your CUDA one must have a symbol but the parralel Nsight one must not etc
- asharp 15y agoI greatly doubt that it is faster to compute on the fly then to use a rainbow table.
- nobody3141592 15y agoI think the record is just under 1Billion hashes/sec on a couple of NVidia Tesla cards linked by SLI. You need a fairly expensive SAN to pull 1Billion MD5 hashes/second just from the raw disk - nevermind the DB lookup.
- deleted 15y ago[deleted]
- tptacek 15y agoThe salt does not matter. Neither does the specific hash; you'd be just as boned using SHA256. All cryptographic hash functions are designed to be fast. The vulnerability is "not using a password hash construction", of which the best known are bcrypt and PBKDF2.
- pork 15y agoHate to be pedantic, and I'm sure you already know this, but you do realize that PBKDF2 uses SHA in HMAC mode right? There's nothing inherently slow about that, it's the repeated iterations of hashing. You could slap MD5 into PBKDF2 with a high iteration count and achieve comparable security. The problem is that devs often use a hash function a single time.
- tptacek 15y agoI'm drawing a line between "cryptographic hash functions" and "password hash constructions". One is a "function", the other a "construction". Password hash constructions do more than simply run the hash function multiple times. We are, obviously, saying much the same thing. Again: the key point here is, don't DIY this part of your application.
- pork 15y agoFair enough, I suppose I didn't read your original comment closely enough. I appreciate your essays on the topic, but I fear that too many people have, without a full understanding, drawn the conclusion from them that SHA = bad, bcrypt/pbkdf2 = good, without fully realizing that SHA is an integral part of pbkdf2.
- deleted 15y ago[deleted]