NYCPHP Meetup

[George Schlossnagle]

On Aug 22, 2004, at 10:29 PM, Chris Shiflett wrote:

> --- Hans Zaunere <hans at nyphp.com> wrote:
>> An interesting project would be to see if two UNIX timestamps exist 
>> that
>> produce the same MD5.
>
> Well, are you considering a UNIX timestamp to be any positive integer? 
> :-)
> If so, there are definitely collisions somewhere, because there are 
> more
> inputs than possible outputs.
>
> I've always heard the top crypto guys saying that MD5 was weaker than
> people thought; I guess they were right. Still, I wouldn't mind seeing 
> one
> of these experts comment on whether it is dangerous to be using MD5 for
> passwords and such.

Of course the danger isn't in a collision - collisions exist by 
definition as part of a hashing system.  The danger is in being able to 
generate a collision for an arbitrary input, as this would render the 
'fingerprinting' aspect of the scheme useless.  This isn't part of the 
result, but the general worry is that such a result will follow.

George