Editing MD5 (section)

=== Overview of security issues ===
In 1996, a flaw was found in the design of MD5. While it was not deemed a fatal weakness at the time, cryptographers began recommending the use of other algorithms, such as [[SHA-1]], which has since been found to be vulnerable as well.<ref>{{cite web|url=http://ftp.arnes.si/packages/crypto-tools/rsa.com/cryptobytes/crypto2n2.pdf.gz|title=The Status of MD5 After a Recent Attack|author=Hans Dobbertin|work=CryptoBytes|volume=2|issue=2|date=Summer 1996|access-date=22 October 2013}}</ref>
In 2004 it was shown that MD5 is not [[collision-resistant]].<ref>{{cite web|url=http://merlot.usc.edu/csac-f06/papers/Wang05a.pdf|title=How to Break MD5 and Other Hash Functions|author1=Xiaoyun Wang|author2=Hongbo Yu |work=Advances in Cryptology – Lecture Notes in Computer Science|volume=3494|pages=19–35|year=2005|access-date=21 December 2009|archive-url=https://web.archive.org/web/20090521024709/http://merlot.usc.edu/csac-f06/papers/Wang05a.pdf|archive-date=21 May 2009}}</ref> As such, MD5 is not suitable for applications like [[Transport Layer Security|SSL]] [[public key certificate|certificates]] or [[digital signature]]s that rely on this property for digital security. Researchers additionally discovered more serious flaws in MD5, and described a feasible [[collision attack]]—a method to create a pair of inputs for which MD5 produces identical [[checksum]]s.<ref name="autogenerated2">J. Black, M. Cochran, T. Highland: [http://www.cs.colorado.edu/~jrblack/papers/md5e-full.pdf A Study of the MD5 Attacks: Insights and Improvements] {{Webarchive|url=https://web.archive.org/web/20150101093005/http://www.cs.colorado.edu/%7Ejrblack/papers/md5e-full.pdf |date=1 January 2015 }}, 3 March 2006. Retrieved 27 July 2008.</ref><ref name="autogenerated1">Xiaoyun Wang, Dengguo ,k.,m.,m, HAVAL-128 and [[RIPEMD]], Cryptology ePrint Archive Report 2004/199, 16 August 2004, revised 17 August 2004. Retrieved 27 July 2008.</ref> Further advances were made in breaking MD5 in 2005, 2006, and 2007.<ref>Marc Stevens, Arjen Lenstra, Benne de Weger: [http://www.win.tue.nl/hashclash/SoftIntCodeSign/ Vulnerability of software integrity and code signing applications to chosen-prefix collisions for MD5] {{Webarchive|url=https://web.archive.org/web/20071213023720/http://www.win.tue.nl/hashclash/SoftIntCodeSign/ |date=13 December 2007 }}, 30 November 2007. Retrieved 27 July 2008.</ref> In December 2008, a group of researchers used this technique to fake [[SSL certificate]] validity.<ref name="sslHarmful">{{cite web |url=http://www.win.tue.nl/hashclash/rogue-ca/ |title=MD5 considered harmful today |last=Sotirov |first=Alexander |author2=Marc Stevens |author3=Jacob Appelbaum |author4=Arjen Lenstra |author5=David Molnar |author6=Dag Arne Osvik |author7=Benne de Weger |date=30 December 2008 |access-date=30 December 2008 |archive-date=25 March 2017 |archive-url=https://web.archive.org/web/20170325033522/http://www.win.tue.nl/hashclash/rogue-ca/ |url-status=live }} [https://events.ccc.de/congress/2008/Fahrplan/events/3023.en.html Announced] {{Webarchive|url=https://web.archive.org/web/20181116081156/https://events.ccc.de/congress/2008/Fahrplan/events/3023.en.html |date=16 November 2018 }} at the 25th [[Chaos Communication Congress]].</ref><ref name="browserflaw">{{cite web
|url=http://news.cnet.com/8301-1009_3-10129693-83.html
|title=Web browser flaw could put e-commerce security at risk
|last=Stray
|first=Jonathan
|date=30 December 2008
|access-date=24 February 2009
|publisher=[[CNET.com]]
|archive-date=28 August 2013
|archive-url=https://web.archive.org/web/20130828142658/http://news.cnet.com/8301-1009_3-10129693-83.html
}}</ref>

As of 2010, the [[CMU Software Engineering Institute]] considers MD5 "cryptographically broken and unsuitable for further use",<ref>{{cite web |url=http://www.kb.cert.org/vuls/id/836068 |title=CERT Vulnerability Note VU#836068 |publisher=Kb.cert.org |access-date=9 August 2010 |archive-date=21 March 2017 |archive-url=https://web.archive.org/web/20170321141233/http://www.kb.cert.org/vuls/id/836068 |url-status=live }}</ref> and most U.S. government applications now require the [[SHA-2]] family of hash functions.<ref>{{cite web |url=http://csrc.nist.gov/groups/ST/hash/policy.html |title=NIST.gov&nbsp;— Computer Security Division&nbsp;— Computer Security Resource Center |publisher=Csrc.nist.gov |access-date=9 August 2010 |archive-url=https://web.archive.org/web/20110609064344/http://csrc.nist.gov/groups/ST/hash/policy.html |archive-date=9 June 2011 }}</ref>  In 2012, the [[Flame (malware)|Flame]] malware exploited the weaknesses in MD5 to fake a Microsoft [[digital signature]].<ref name="foo">{{cite web|url=http://blogs.technet.com/b/srd/archive/2012/06/06/more-information-about-the-digital-certificates-used-to-sign-the-flame-malware.aspx|title=Flame malware collision attack explained|access-date=7 June 2012|archive-url=https://web.archive.org/web/20120608225029/http://blogs.technet.com/b/srd/archive/2012/06/06/more-information-about-the-digital-certificates-used-to-sign-the-flame-malware.aspx|archive-date=8 June 2012}}</ref>