> because they perform risk-analysis: > - what are the threats to my assets? > - which role does MD5 play there? > - any subsequent risk then from using it? > - high priority risk? mitigating controls or risk acceptance?
Don't kid yourself. Very few businesses in my experience think about this stuff when they go to use a hash. Most just use whatever hash they're used to using. I rarely see clients actually sitting down and thinking about what the application of a given hash is and what the threats are in their specific case. > would you be so kind to show me a real-world attack against a VPN > using MD5 hashing? ... Assuming there are no real-world attacks against your particular VPN that uses MD5, does that make it safe for the rest of us in any given application? A rather leading question IMO. tim _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
