Vilhelm Gray
Reputation
Top tag
Next privilege 150 Rep.
Create tags
 Apr6 awarded Popular Question Feb2 awarded Autobiographer May14 comment Using an MD5 hash as a password @RolandSmith Not necessarily: virtually all *nix operating systems come with an md5sum command. May14 awarded Scholar May14 accepted Using an MD5 hash as a password May14 comment Using an MD5 hash as a password I see, so even though the entropy may technically drop, the drop is probably so small that there's no significant difference to the entropy. May14 comment Using an MD5 hash as a password After reading a bit more, I realized I was confusing a collision attack with a second-preimage attack. Regarding my second question, I'm still confused about whether there is an inherent drop to entropy due to an unintentional collision. May14 awarded Student May14 comment Using an MD5 hash as a password Also, in the case of a brute-force attack -- where a random guess is hashed then attempted as the password -- wouldn't the possibility of a collision drop the entropy, or does it only drop for passphrases with entropy greater than MD5's 2^128? May14 comment Using an MD5 hash as a password While I'm aware MD5 is cryptographically broken (which is why I specifically used it in the example), I'm not familiar with actual exploitation techniques. Is the fact the hash is kept a secret the reason why a collision attack is impossible here? May14 comment Using an MD5 hash as a password Do you mean "second-preimage resistance?" May14 awarded Supporter May14 revised Using an MD5 hash as a password The magnitude of the hexadecimal digit set is 16 (a-f, 0-9), not 36; May14 awarded Editor May14 revised Using an MD5 hash as a password MD5 hash can be represented as 32 hexadecimal digits, not 16; May14 comment Using an MD5 hash as a password Oops, you're right I misread the information about the length of an MD5 hash. Also, what would be the difference between using more modern hash function such as SHA-2 over the older MD5, if there is no security issue with MD5? May14 asked Using an MD5 hash as a password