|author||Colin Percival <cperciva@FreeBSD.org>||2009-01-06 19:25:24 +0000|
|committer||Colin Percival <cperciva@FreeBSD.org>||2009-01-06 19:25:24 +0000|
Strengthen some of the language concerning attacks on MD5, in light of the
recent demonstration of a forged SSL certificate. Add text pointing out that SHA-1 is at least theoretically broken. Add a recommendation that new applications use SHA-256. MFC after: 1 month
Notes: svn path=/head/; revision=186836
Diffstat (limited to 'sbin/md5/md5.1')
1 files changed, 16 insertions, 8 deletions
diff --git a/sbin/md5/md5.1 b/sbin/md5/md5.1
index 09729536121d..bb2b3f4129f4 100644
@@ -49,15 +49,23 @@ key under a public-key cryptosystem such as
.Tn RSA .
-has not yet (2007-03-05) been broken, but sufficient attacks have been
-made that its security is in some doubt.
-The attacks on
+has been completely broken as far as finding collisions is
+concerned, and should not be relied upon to produce unique outputs.
+This also means that
-are in the nature of finding
-\(em that is, multiple
-inputs which hash to the same value; it is still unlikely for an attacker
-to be able to determine the exact original input given a hash value.
+should not be used as part of a cryptographic signature scheme.
+At the current time (2009-01-06) there is no publicly known method to
+"reverse" MD5, i.e., to find an input given a hash value.
+currently (2009-01-06) has no known collisions, but an attack has been
+found which is faster than a brute-force search, placing the security of
+It is recommended that all new applications use
+instead of one of the other hash functions.
The following options may be used in any combination and must
precede any files named on the command line.