Is there any security concerns with building a CSPRNG using a broken hash function like MD5 or SHA1? The design is such that a CRC-like function is used for mixing entropy and MD5 is used as the output function. If this is a security concern, what is the technical reason? What would be a better replacement when efficient is a concern?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Well, it is quite possible to have a CSPRNG that uses MD5, or SHA-1, despite their known flaws. In fact, see Hash_DRBG with SHA-1 for an example that is officially endorsed by the US Government. They don't endorse it for MD5; however, they really don't endorse MD5 for any reason (except within the TLS key derivation function).
The problem with MD5 and SHA-1 is that it is possible to create two different images that hash to the same value (with MD5, it turns out that you have quite a bit of flexibility, with SHA-1, it's been estimated to be practical, however I have not heard of anyone actually generating a colliding pair). However, creating a collision means that the attacker gets to select both pairs; with a CSPRNG, the attacker cannot influence the internal state (he can only observe). This implies that the ability to create a collision has no impact on CSPRNG security; after all, even if the attacker generates a colliding pair, he has no way of making the CSPRNG use one of the preimages he has created.
Also, one warning: just because it is possible to design a CSPRNG based on SHA-1 or MD5 doesn't mean that design that you have in mind is actually secure.
Now, when you talk about efficiency, well, SHA-1 and MD5 aren't great; they're designed to hash things quickly, not generate hashed bytes quickly (oddly enough, those aren't the same thing). The CTR_DRBG CSPRNG from the same document is somewhat better; however, the output of a good keystream generator (such as ISAAC) is going to be faster still.