note 88034 deleted from function.md5 by danbrown

From: Date: Wed, 07 Jan 2009 04:11:17 +0000
Subject: note 88034 deleted from function.md5 by danbrown
References: 1  Groups: php.notes 
Request: Send a blank email to php-notes+get-148910@lists.php.net to get a copy of this message
Note Submitter: rehfeld at georg-rehfeld dot de ---- Before using MD5 for anything, please be aware that this hash function is cryptographically broken and should not be used. There are alternatives such as SHA-1. Read http://www.kb.cert.org/vuls/id/836068 and note the following paragraph: "Do not use the MD5 algorithm Software developers, Certification Authorities, website owners, and users should avoid using the MD5 algorithm in any capacity. As previous research has demonstrated, it should be considered cryptographically broken and unsuitable for further use." --- Notes: This message text was from someone else (???@selfhtml.org), I noted the same thing in other words (anonymous as "deerwood"). Obviously some moderator (or may be some evil person???) removes these notes and thus refuses to inform users of the broken MD5 algorithm, but (intentionally?) leaves in the note http://php.net/manual/function.md5.php#52500 . I consider this bad behaviour. The flaw itself is NOT in PHP (or any OS or Browser) but in the MD5 algorithm (for sure in some other hash algorithms too). SHA-1 seems to be useable for some future, but was attacked in a similar way already. BEFORE again deleting this (or a similar) message I insists of beeing informed! Regards, Georg

« previous php.notes (#148910) next »