2

On my RHEL6 linux is configured to use MD5 password hashing is the linux usage of MD5 for password hashing considered secure?

Improve this question
2
  • AFAIK the MD5 password hashes reduce the impact in case of a security failure which would allow to read the password file. Still if MD5 hashes are optained, brute forcing becomes easier. So i think MD5 password hashes are not "secure" but "safer".
    – snies
    Commented Apr 6, 2012 at 3:35
  • 1
    The main point is that if one has received privileges to read the /etc/shadow file, one has most probably gotten root privileges, and then all is lost anyway. One could then e.g. just blank out the password in the file, or use e.g. passwd to change it to whatever, replace the login binary to log when the user enters the password, just read all users files without restrictions directly, etc. A rooted box is doomed in all security contexts, if the "rooter" is malicious. Not storing it in plaintext at least hinders "accidental" rooters, or something.
    – Daniel Andersson
    Commented Apr 6, 2012 at 9:21

1 Answer 1

Reset to default
3

While MD5 still maintains its preimage resistance for practical purposes (given the hash, it is difficult to obtain the message), it has a big flaw when used for authentication: its quickness.

Short passwords can be easily discovered, using either a rainbow table (a list containing many common passwords and their respective hashes) or simply a brute-force attack (trying all possible passwords). Modern desktop computers are very good at this. Commercial programs that use your GPU to try multiple passwords in parallel can try billions of passwords per second.

This problem can be solved easily by choosing a password that is long and/or complex enough. Slower algorithms could achieve the same security level with weaker passwords.

Also, an attacker needs either shadow privileges or physical access to the hard drive in order to read the contents of /etc/shadow (where the hash is stored). This means that anyone who can read the hash doesn't need to crack your password to gain access to your computer. So, if you use your password only on that computer, you have nothing to worry about.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .