Impact of MD5 Security On Digest Authentication
The MD5 calculations used in HTTP digest authentication is intended to be "one way", meaning that it should be difficult to determine the original input when only the output is known. If the password itself is too simple, however, then it may be possible to test all possible inputs and find a matching output (a brute-force attack) – perhaps aided by a dictionary or suitable look-up list.
The HTTP scheme was designed by Phillip Hallam-Baker at CERN in 1993 and does not incorporate subsequent improvements in authentication systems, such as the development of keyed-hash message authentication code (HMAC). Although the cryptographic construction that is used is based on the MD5 hash function, collision attacks were in 2004 generally believed to not affect applications where the plaintext (i.e. password) is not known. However, claims in 2006 (Kim, Biryukov2, Preneel, Hong, "On the Security of HMAC and NMAC Based on HAVAL MD4 MD5 SHA-0 and SHA-1") cause some doubt over other MD5 applications as well. So far, however, MD5 collision attacks have not been shown to pose a threat to digest authentication, and the RFC 2617 allows servers to implement mechanisms to detect some collision and replay attacks.
Read more about this topic: Digest Access Authentication
Famous quotes containing the words impact of, impact, security and/or digest:
“The question confronting the Church today is not any longer whether the man in the street can grasp a religious message, but how to employ the communications media so as to let him have the full impact of the Gospel message.”
—Pope John Paul II (b. 1920)
“Too many existing classrooms for young children have this overriding goal: To get the children ready for first grade. This goal is unworthy. It is hurtful. This goal has had the most distorting impact on five-year-olds. It causes kindergartens to be merely the handmaidens of first grade.... Kindergarten teachers cannot look at their own children and plan for their present needs as five-year-olds.”
—James L. Hymes, Jr. (20th century)
“There is something that Governments care for far more than human life, and that is the security of property, and so it is through property that we shall strike the enemy.... Be militant each in your own way.... I incite this meeting to rebellion.”
—Emmeline Pankhurst (1858–1928)
“To save the theatre, the theatre must be destroyed, the actors and actresses must all die of the plague. They poison the air, they make art impossible. It is not drama that they play, but pieces for the theatre. We should return to the Greeks, play in the open air: the drama dies of stalls and boxes and evening dress, and people who come to digest their dinner.”
—Eleonora Duse (1858–1924)