General « Blogging with attitude!

28Sep/090

md5!

Officially changed to md5! dont ask why! TQ

In cryptography, MD5 (Message-Digest algorithm 5) is a widely used cryptographic hash function with a 128-bit hash value. As an Internet standard (RFC 1321), MD5 has been employed in a wide variety of security applications, and is also commonly used to check the integrity of files. However, it has been shown that MD5 is not collision resistant^[1]; as such, MD5 is not suitable for applications like SSL certificates or digital signatures that rely on this property. An MD5 hash is typically expressed as a 32 digit hexadecimal number.

MD5 was designed by Ron Rivest in 1991 to replace an earlier hash function, MD4. In 1996, a flaw was found with the design of MD5. While it was not a clearly fatal weakness, cryptographers began recommending the use of other algorithms, such as SHA-1 (which has since been found vulnerable). In 2004, more serious flaws were discovered, making further use of the algorithm for security purposes questionable.^[2]^[3] In 2007 a group of researchers including Arjen Lenstra described how to create a pair of files that share the same MD5 checksum.^[4] In an attack on MD5 published in December 2008, a group of researchers used this technique to fake SSL certificate validity.^[5]^[6] US-CERT of the U. S. Department of Homeland Security said MD5 "should be considered cryptographically broken and unsuitable for further use,"^[7] and most U.S. government applications will be required to move to the SHA-2 family of hash functions by 2010.^[8]