[37648] in bugtraq
Re: MD5 To Be Considered Harmful Someday
daemon@ATHENA.MIT.EDU (Dan Kaminsky)
Wed Dec 8 17:58:14 2004
Message-ID: <41B775A8.60203@doxpara.com>
Date: Wed, 08 Dec 2004 13:44:08 -0800
From: Dan Kaminsky <dan@doxpara.com>
MIME-Version: 1.0
To: George Georgalis <george@galis.org>
Cc: David Schwartz <davids@webmaster.com>, gandalf@digital.net,
BugTraq <bugtraq@securityfocus.com>
In-Reply-To: <20041208213056.GB1161@sta>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
>Since you can't possibly mean absolutely suitable, can you clarify your
>basis for suitability? I'm not asking for a technical proof, just the
>general metrics used to make the determination.
>
>If 160 bit SHA1 is good enough for one application but not another, what
>does one need to know to decide for their own application?
>
>
SHA-1 is truncatable to 128 bits for applications that have limited
space available for hashes. This limits the birthday paradox attack to
a 2^64 effort, but MD5 isn't anywhere close to that anymore.
(Incidentally, the output of birthday attack is an unchosen collision,
just like Wang's.)
SHA-1 isn't perfect, but we haven't known its been broken for a decade
like we have for MD5.
--Dan
