News for hackers. Stuff that matters.

A comment on Security Issue February 2019: FAQ. Parent comment

Re:Security Issue February 2019: FAQ by nehpe on Friday February 15, 2019 @11:55AM (#19172446)
> Curious to know if there are downsides to this (performance is an obvious one) or whether you're weakening the stronger hash by hashing a weaker one?

You're weakening the stronger hash by hashing the weaker one. The two main problems of MD5 are entropy (128-bit maximum) and collisions (because of lack of entropy).

By always hashing to MD5, you are losing the entropy of the stronger hashing algorithm.

[ Parent | on HN ]
Re:Security Issue February 2019: FAQ by mystickphoenix on Friday February 15, 2019 @12:24PM (#19172752)
Confirms a suspicion I had that it might be an issue. I assume it's a problem whenever you hash a weaker with a stronger, not just MD5 in particular.

Thanks!

[ Parent | on HN ]
Re:Security Issue February 2019: FAQ by Dylan16807 on Friday February 15, 2019 @10:04PM (#19176776)
It does cap it at 128 bits, but it is not an issue. 128 bits of entropy is plenty.
[ Parent | on HN ]