The MD5 algorithm is no longer considered secure for most applications of a hash algorithm. However, is it safe to initialize a PRNG via a password?
If it is not, how could it be exploited?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this communityThe MD5 algorithm is no longer considered secure for most applications of a hash algorithm. However, is it safe to initialize a PRNG via a password?
If it is not, how could it be exploited?
No, it is not safe to initialize a (CS)PRNG with the MD5 hash of a password.
That's not so much an issue with MD5 as it is an issue with initializing a PRNG with a function of a password that can be computed fast. SHA-256 would be nearly as bad. When turning a password into a key/seed, we need to use key/entropy stretching, and towards this use a memory-hard function such as Argon2, with reasonable parameters. Otherwise, we risk being very vulnerable to password cracking.
Also, inasmuch as possible, an input of the function should include salt (such as a username, email, filename).
how could it be exploited?
The attacker would hash a dictionary of common passwords, and for each initialize the PRNG with the result, produce some PRNG output, and test if that output is correct. That test depends on the usage of the PRNG. For example, if the PRNG is used as a stream generator for a stream cipher, and a known plaintext/ciphertext pair is available, the test boils down to comparing the PRNG output to the XOR of plaintext and ciphertext over an appropriate length. If only ciphertext is available, but correct plaintext is recognizable (e.g is highly redundant), an attack is still possible.