Re: Passwords

on 5/6/00 9:54 PM, The Hermit Hacker at scrappy(at)hub(dot)org wrote:

> My *understanding* is that MD5 is a half-way measure that is easier to
> break then DES, which is why it isn't under the export restrictions ...

No, MD5 only provides hashing. You can never "unhash" something, so you can
never use MD5 as a real encryption function (which would need to be
reversible if you ever want to decrypt your message). Thus, since MD5 does
not allow you to encrypt data, it doesn't fall under any export
restrictions. It is *very* hard, and most probably impossible to find
collisions in the MD5 hashing function (which would allow you to break the
password scheme based on it).

With a DES-based crypt command, you can actually reverse the process. Take
your "crypted" password, and decrypt it using DES and the cleartext password
as the key. You'll manage to get back to the original block of "0"s that you
started with. That's why DES is export-controlled...

-Ben