3 ms·
Possibly truly stupid question, but what is the attack on md5ing passwords if you also generate a random salt for each user? I could not find anything online in
by sunir 17y ago
Possibly truly stupid question, but what is the attack on md5ing passwords if you also generate a random salt for each user? I could not find anything online in the past ten minutes that suggests an attack, except for the md5 collision problem.
I don't understand the collision problem very well either. I know it's been used to crack a certificate here or there, but it seems like it took a lot of resources to crack one password.
- tptacek 17y agohttp://www.matasano.com/log/958/enough-with-the-rainbow-tables-what-you-need-to-know-about-secure-password-schemes/ http://www.matasano.com/log/958/enough-with-the-rainbow-tabl...
- sunir 17y agoThomas, thanks. That was immensely helpful. Now I have to figure out what I want to do going forward. At least I already have per-user random salts.
- jameskpolk 17y agoThe collision problem is a huge deal. You can no longer trust a MD5 signed object. http://www.mscs.dal.ca/~selinger/md5collision/ http://www.mscs.dal.ca/~selinger/md5collision/ has some great, and very scary examples.