On Mon, 2004-02-23 at 00:01, Evan Nemerson wrote: > What you would have to do is find a collision, which is thankfully difficult > to do- if it were easy, MD5 would be useless. Theoretically, you could modify > say John The Ripper and have it brute force something, but you may end up > waiting a few lifetimes :)
Just as a note, check out www.md5crk.com. They aim to do just this and imho have a good plan of attack. I have already moved to sha1 for passwords, this is only further support of why it's time to move on. > I'd recommend PGP/GPG signing instead- anyone can create a valid MD5 checksum, > but only you can cryptographically sign your files (theoretically- if someone > else can, you've got serious problems) > > Everyone seems happy enough with detached signatures. Also, you could use the > OpenPGP specification to do what you want, just like when you send a > PGP-signed e-mail the signature and the message are all in a single > container. You may have to hack GPG a bit (not as difficult as you'd think) > to have the PGP stuff in PHP comments, but i think you could do it... Sorry, > I'm rambling. Here, here, PGP adds more benefits as long as you don't leak your private key. You could always try and wrap everything as a mime message or zip the two together. Also, place a link to the pgp signature in the README file. Not that anyone ever reads those though. ;) -- Adam Bregenzer [EMAIL PROTECTED] http://adam.bregenzer.net/ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
