note 88010 deleted from function.md5 by danbrown
| From: | danbrown@php.net | Date: | Tue, 06 Jan 2009 05:17:54 +0000 |
| Subject: | note 88010 deleted from function.md5 by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-148874@lists.php.net to get a copy of this message | ||
Note Submitter: deerwood
----
Please DO NOT use MD5 anymore for serious work. MD5 now is proven to be broken seriously. Read http://www.win.tue.nl/hashclash/rogue-ca/ to
understand that yourself!
They were able to forge a certificate allowing them to sign EVERY website they want to, so that no
commomnly used browser would complain. In only 3 days. Luckily these people are wearing the
"white hat"!
Other work of crypto-experts reveals, that it is possible to produce e.g. more then 10 very
different PDF documents, all with the same MD5 hash, in a few hours. See http://www.win.tue.nl/hashclash/Nostradamus/
You are warned now.