note 88034 deleted from function.md5 by danbrown
| From: | danbrown@php.net | Date: | Wed, 07 Jan 2009 04:11:17 +0000 |
| Subject: | note 88034 deleted from function.md5 by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-148910@lists.php.net to get a copy of this message | ||
Note Submitter: rehfeld at georg-rehfeld dot de
----
Before using MD5 for anything, please be aware that this hash function is cryptographically broken
and should not be used. There are alternatives such as SHA-1.
Read http://www.kb.cert.org/vuls/id/836068 and
note the following paragraph:
"Do not use the MD5 algorithm
Software developers, Certification Authorities, website owners, and users should avoid using the MD5
algorithm in any capacity. As previous research has demonstrated, it should be considered
cryptographically broken and unsuitable for further use."
---
Notes:
This message text was from someone else (???@selfhtml.org), I noted the same thing in other words
(anonymous as "deerwood").
Obviously some moderator (or may be some evil person???) removes these notes and thus refuses to
inform users of the broken MD5 algorithm, but (intentionally?) leaves in the note http://php.net/manual/function.md5.php#52500
. I consider this bad behaviour.
The flaw itself is NOT in PHP (or any OS or Browser) but in the MD5 algorithm (for sure in some
other hash algorithms too).
SHA-1 seems to be useable for some future, but was attacked in a similar way already.
BEFORE again deleting this (or a similar) message I insists of beeing informed!
Regards, Georg