Subject: MD5

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Fri, 25 Aug 2000 13:54:28 -0400

I've gotten two private messages saying, in effect, "what's wrong with
MD5"?

It's one of those judgement things.  Script kiddies are not routinely
breaking MD5 on their PCs.  But over three years ago in 1997, RFC 2104
which defines HMAC, said the following:

"Note: To the date of writing of this document MD5 and SHA-1 are the
most widely used cryptographic hash functions. MD5 has been recently
shown to be vulnerable to collision search attacks [Dobb]. This attack
and other currently known weaknesses of MD5 do not compromise the use
of MD5 within HMAC as specified in this document (see [Dobb]);
however, SHA-1 appears to be a cryptographically stronger function. To
this date, MD5 can be considered for use in HMAC for applications
where the superior performance of MD5 is critical. In any case,
implementers and users need to be aware of possible cryptanalytic
developments regarding any of these cryptographic hash functions, and
the eventual need to replace the underlying hash function."

RSA/MD5 signatures do not use HMAC but use direct MD5 under the RSA
encryption.

Donald
=====================================================================
 Donald E. Eastlake 3rd    [email-masked]
 140 Forest Avenue     +1 978-562-2827(h)
 Hudson, MA 01749 USA  +1 508-261-5434(w)

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.