First of all, congrats to the people who pulled this off. A couple of the authors are friends of mine, and I heard a few weeks ago that they were going to annou

First of all, congrats to the people who pulled this off. A couple of the authors are friends of mine, and I heard a few weeks ago that they were going to announce something major today, but this is still bigger than I expected. In a way, I'm very gratified to see this. Let me explain. I used to do hash function research a couple of years ago before I shifted to other things. I've also worked in a team building a security product. When I suggested that they should stop using MD5 to publish hashes of worm binaries, they weren't sure why I wanted them to do that. This was well after MD5 collisions had been widely publicized. I brought it up in a meeting, and they said that other teams also used MD5s, so it would be confusing for users to have two different formats, and so they weren't going to switch "until everyone else did." I was very surprised, but dropped it because I figured I was getting a taste of how things worked in the real world. In my life as an academic, the one thing I've repeatedly observed is that the disconnect between people doing research and people directly applying that research is huge. Seriously, what does one have to do? It's not like we're trying to educate end-users here -- root CA's are in the business of staying on top of this stuff. Sheesh. Edit. The talk video is available at http://tinyurl.com/a9754t http://tinyurl.com/a9754t but it's kinda slow right now.