Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ars technica posted an article about the latest in cyber warfare from the stuxnet crew.

They key stretched MD5 by iterating it 10,000 times. It seems to be effective at handicapping HashCat's gpu acceleration. Had I been them I would have used bcrypt instead.

Why/When would someone prefer streched-md5 over bcrypt?
How is bcrypt superior to a strectched-MD5?

If you've got the math power $MD5(password)^n = bcrypt(password)$ solve for $N$.

share|improve this question
You mention the MD5 iteration count, but not the bcrypt work-factor - in terms of security, there's a relationship between the two. The (loose) recommendation for PBKDF2 using SHA256 (a much more robust hash than MD5) in 2013 is somewhere in the order of 50000 to 100000 iterations (and increasing exponentially), so 10000 iterations of MD5 doesn't seem very secure. For low-entropy input such as passwords, Scrypt is widely considered to offer better security than Bcrypt and PBKDF2. One disadvantage of Bcrypt is that the output length is not configurable. – hunter Mar 15 '13 at 4:01
So what I'm pulling from comments and answers is that there isn't really reason the stuxnet crew used MD5 instead of a better password oriented hash. – deft_code Mar 15 '13 at 18:16
not an obvious reason, no. There are much, much stronger options which are quite commonplace, and not hard to implement. Look at the chart below; compared with PBKDF2 (using sha256, as below) key-stretching with MD5 and a similar number of iterations would be much weaker. – hunter Mar 15 '13 at 18:59

Any time there is a choice and password search is an issue, one should prefer scrypt or perhaps bcrypt to stretched-md5, or even PBKDF2.

The reason is that scrypt and bcrypt provide better security, by requiring a bigger investment in hardware (in particular, RAM) for the would-be password cracker, assuming parametrization yielding the same runtime for legitimate use. If enough RAM is available in legitimate use, the additional security obtained by using scrypt can be quite dramatic. See the following table from the paper Stronger Key Derivation via Sequential Memory-Hard Functions defining the Scrypt Password-Based Key Derivation Function.

Estimated cost of hardware to crack a password in one year

share|improve this answer
Best table ever. I just came across this a couple weeks ago when discussing the evernote breach and have since presented it to upper management. Also, there was a great talk on these types of hashing algorithms via Security Now #388. – JZeolla Mar 21 '13 at 13:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.