News for hackers. Stuff that matters.

A comment on Maybe we shouldn't skip SHA-3. Parent comment

Re:Maybe we shouldn't skip SHA-3 by cryptonector on Friday June 02, 2017 @11:26AM (#14470574)
Yes-ish. I don't sweat HMAC-MD5, nor HMAC-SHA-1. What really sucks though is when you can't use them (even though for interop reasons you must) because some stupid auditor (typically software) goes "oh no! MD5 found!! alert! alert!".
[ Parent | on HN ]
Re:Maybe we shouldn't skip SHA-3 by iRobbery on Friday June 02, 2017 @11:57AM (#14470843)
Heh heard that one, and the always very convincing answer in a discussion to do or not do certain things...

"if it is on the checklist, then.. it is on the checklist"

[ Parent | on HN ]
Re:Maybe we shouldn't skip SHA-3 by cryptonector on Friday June 02, 2017 @02:19PM (#14472169)
There is lots of junk on those checklists. Like "must implement n-strikes you're locked", which is idiotic in many contexts.
[ Parent | on HN ]
Re:Maybe we shouldn't skip SHA-3 by azinman2 on Friday June 02, 2017 @01:16PM (#14471637)
For us who don't know better, could you explain why MD5 or SHA1 are ok in an HMAC context?
[ Parent | on HN ]
Re:Maybe we shouldn't skip SHA-3 by tptacek on Friday June 02, 2017 @02:03PM (#14472048)
Because a collision in MD5 doesn't give you a second preimage of an MD5 hash.
[ Parent | on HN ]