Re: [PATCH] md4 for openssl 0.9.5a

[Evan Carew]

Because if it is bundled into a standard package such as this you can ship source or executable code designed to link to it that will do things like crack open NT boxes that still use it. Recently, while at a major bank in the US Midwest, I had occasion to need a way to get into an NT domain as the administrator to fix some problems the certified MS Winsowz weenies had gotten themselves into. I kid you not, I was able to dump the entire domains list of decrypted passwords & ids in much less time than it took you to read this short message.

A note the the security sensitive, regardless of the industry you are in, as a developer, sooner or later your job will require you to prove the king has no clothing. In my case the best way to prove this was to take the domain's printout of ids and passwords to a departmental meeting where the business folk and IT were in one place at one time. Let me tell you, there's nothing like a few visual aids to put an end to a OS related religious war. Along those lines, I will be announcing a rewrite of the popular L0pht crack routines that will easily port to any platform that can run this library.

Lewis McCarthy wrote:

Hi,
 

MD4 has had a pile of very successful cryptanalysis against it
for some time now. The RSA Security Crypto FAQ even says,
"Clearly, MD4 should now be considered broken."
Why would you want to start using it?

-Lewis
 

begin:vcard 
n:Carew;Evan
tel;work:(313) 859-9691
x-mozilla-html:TRUE
url:http://home.msen.com/~carew
adr:;;;;;;
version:2.1
email;internet:[EMAIL PROTECTED]
x-mozilla-cpt:;8512
fn:Evan Carew
end:vcard