To MD5 or not to MD5

[XTF]

As far as I know, the security of MD5 isn't the best, see http://en.wikipedia.org/wiki/MD5
Wouldn't it make sense to move away from MD5 and use for example SHA1?

[Ryan H.]

SHA1 is hardly better. bcrypt or an alternative would be optimal, but there are implementation problems that mean it probably won't be happening soon [mostly lack of support and cross-platform compatibility].

If you're interested in a lot of reading, I had a topic on security concerns a couple months ago. It touched on this, among other things. http://community.inv...board-security/

[XTF]

SHA1 is hardly better.

Is it? For strong long passwords it seems much better. For short passwords maybe not so much.

[Ryan H.]

Is it? For strong long passwords it seems much better. For short passwords maybe not so much.

It suffers from the same fundamental problem that MD5 does, which is that it is a hash function, not a cryptographic method. It is designed to be as fast as possible to calculate, which means that hardware can be optimized to process the hashes extremely quickly--for a modern GPU, hundreds of millions per second. If brute force attacks aren't a concern, the hashing technique is largely irrelevant anyway.

[bfarber]

There are rainbow tables for SHA1, so realistically it would suffer the same side effects (ability to look up a hash, given enough resources) as MD5.

[XTF]

Don't good salts make rainbow tables useless?

[bfarber]

Rainbow tables take into account salts now - most have options on the order and how the hashes are computered (salt first - password second, salt first and md5'd - password second and plain text, and so forth).

[XTF]

Doesn't that only work if your salts are too small? If you've got 64 bit salts it'd require you to compute 2^64 rainbow tables. AFAIK computing one table is kinda expensive already, how are you going to compute 2^64?

[euantor]

Given the power of modern machines and the fact you can use your GPU these days to handle tasks like this as well as the CPU, 2^64 really isn't that un-reachable as you might think.

[Ryan H.]

Given the power of modern machines and the fact you can use your GPU these days to handle tasks like this as well as the CPU, 2^64 really isn't that un-reachable as you might think.

And since in most systems the salt is stored in plaintext with the password, it's often simpler to do away with rainbow tables and just go straight at it with a CPU/GPU.

[euantor]

And since in most systems the salt is stored in plaintext with the password, it's often simpler to do away with rainbow tables and just go straight at it with a CPU/GPU.

Exactly. A lot of systems are using considerably outdated password storage mechanisms.

[XTF]

Given the power of modern machines and the fact you can use your GPU these days to handle tasks like this as well as the CPU, 2^64 really isn't that un-reachable as you might think.

Got a reference for that? Note that we're talking about 2^64 rainbow tables, not 2^64 passwords.

And since in most systems the salt is stored in plaintext with the password, it's often simpler to do away with rainbow tables and just go straight at it with a CPU/GPU.

Storing (part of) the salt in a conf file would alleviate that.

[euantor]

Got a reference for that? Note that we're talking about 2^64 rainbow tables, not 2^64 passwords.

There are plenty on why MD5 is bad:

http://blog.cloudfla...ying-up-to-date
http://codahale.com/...ore-a-password/

Then there's also sites like this:

http://www.md5-hash.com/md5-hashing-decrypt/

[XTF]

There are plenty on why MD5 is bad:

I take it you don't get what we're talking about.

[euantor]

I believe I do, though I am new to IPS and may be grasping the wrong end of the stick concerning anything relating to the actual software.