jessenoller.com

This is actu­ally a big thing (that I haven’t seen talked about a lot) — some­one has posted a work­ing pro­gram capa­ble of gen­er­at­ing MD5/4 col­li­sions in under 45 min­utes on a 2.4 GHZ processor.

Bug­track Email here

Web­site with Source

This is sig­nif­i­cant because pre­vi­ously, while every­one knew that MD5 was basi­cally worth­less at this point (due to the How to Break MD5 and Other Hash Func­tions paper, peo­ple con­tin­ues to say “but there’s no exploit code!”.

Now there is. Peo­ple need to start using some­thing in the realm of SHA-256 for hash­ing (SHA-1 is “weaker” then expected) or some other authen­tic­ity method, but really, MD5 is worth­less, and SHA-1 is going to go down as well.

You can see Bruce Schneier’s writ­ing on this as well.

Add: Oh look. Slash­dot finally caught it

This is actually a big thing (that I haven't seen talked about a lot) - someone has posted a working program capable of generating MD5/4 collisions in under 45 minutes on a 2.4 GHZ processor. Bugtrack Email here Website with Source This is significant because previously, while everyone knew that MD5 was basically worthless at this point ...