Impact of MD5 Security On Digest Authentication
The MD5 calculations used in HTTP digest authentication is intended to be "one way", meaning that it should be difficult to determine the original input when only the output is known. If the password itself is too simple, however, then it may be possible to test all possible inputs and find a matching output (a brute-force attack) – perhaps aided by a dictionary or suitable look-up list.
The HTTP scheme was designed by Phillip Hallam-Baker at CERN in 1993 and does not incorporate subsequent improvements in authentication systems, such as the development of keyed-hash message authentication code (HMAC). Although the cryptographic construction that is used is based on the MD5 hash function, collision attacks were in 2004 generally believed to not affect applications where the plaintext (i.e. password) is not known. However, claims in 2006 (Kim, Biryukov2, Preneel, Hong, "On the Security of HMAC and NMAC Based on HAVAL MD4 MD5 SHA-0 and SHA-1") cause some doubt over other MD5 applications as well. So far, however, MD5 collision attacks have not been shown to pose a threat to digest authentication, and the RFC 2617 allows servers to implement mechanisms to detect some collision and replay attacks.
Read more about this topic: Digest Access Authentication
Famous quotes containing the words impact of, impact, security and/or digest:
“Television does not dominate or insist, as movies do. It is not sensational, but taken for granted. Insistence would destroy it, for its message is so dire that it relies on being the background drone that counters silence. For most of us, it is something turned on and off as we would the light. It is a service, not a luxury or a thing of choice.”
—David Thomson, U.S. film historian. America in the Dark: The Impact of Hollywood Films on American Culture, ch. 8, William Morrow (1977)
“Television does not dominate or insist, as movies do. It is not sensational, but taken for granted. Insistence would destroy it, for its message is so dire that it relies on being the background drone that counters silence. For most of us, it is something turned on and off as we would the light. It is a service, not a luxury or a thing of choice.”
—David Thomson, U.S. film historian. America in the Dark: The Impact of Hollywood Films on American Culture, ch. 8, William Morrow (1977)
“Learned institutions ought to be favorite objects with every free people. They throw light over the public mind which is the best security against crafty and dangerous encroachments on the public liberty.”
—James Madison (1751–1836)
“The whole visible universe is but a storehouse of images and signs to which the imagination will give a relative place and value; it is a sort of pasture which the imagination must digest and transform.”
—Charles Baudelaire (1821–1867)