<story><title>Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010</title><url>http://op-co.de/blog/posts/android_ssl_downgrade/</url></story><parent_chain><item><author>echohack</author><text>On the contrary, &amp;quot;It has not been broken&amp;quot; is exactly what I would expect a programmer to say.&lt;p&gt;If the security of an algorithm is weakened, then it&amp;#x27;s important to evaluate the use of the algorithm and make efforts to implement stronger security &lt;i&gt;now&lt;/i&gt;. You should feel fortunate that you even get the time to move to something better before all hell breaks loose.&lt;p&gt;This is the same kind of thinking I hear daily when people say things like, &amp;quot;Just use bcrypt&amp;quot; without thinking about the consequences.&lt;p&gt;The tendency for programmers to think of security in a nihilistic way continues to boggle my mind. I don&amp;#x27;t think the article suffers from an alarmist tone. I think it&amp;#x27;s correct to look at something shitty and call it shit.</text></item><item><author>tptacek</author><text>There&amp;#x27;s interesting technical content here, but it suffers from its alarmist tone.&lt;p&gt;The MD5 hash function is broken, that is true. However, TLS doesn&amp;#x27;t use MD5 in its raw form; it uses variants of HMAC-MD5, which applies the hash function twice, with two different padding constants with high Hamming distances (put differently, it tries to synthesize two distinct hash functions, MD5-IPAD and MD5-OPAD, and apply them both). Nobody would recommend HMAC-MD5 for use in a new system, but it has not been broken.&lt;p&gt;RC4 is horribly broken, and is horribly broken in ways that are meaningful to TLS. But the magnitude of RC4&amp;#x27;s brokenness wasn&amp;#x27;t appreciated until last year, and up until then, RC4 was a common recommendation for resolving both the SSL3&amp;#x2F;TLS1.0 BEAST attack and the TLS &amp;quot;Lucky 13&amp;quot; M-t-E attack. That&amp;#x27;s because RC4 is the only widely-supported stream cipher in TLS. Moreover, RC4 was considered the most computationally efficient way to get TLS deployed, which 5-6 years ago might have been make-or-break for some TLS deployments.&lt;p&gt;You should worry about RC4 in TLS --- but not that much: the attack is noisy and extremely time consuming. You should not be alarmed by MD5 in TLS, although getting rid of it is one of many good reasons to drive adoption of TLS 1.2.</text></item></parent_chain><comment><author>tptacek</author><text>I have no idea what this comment is even trying to say. I have no idea what MD5 has to do with bcrypt, and I have no idea what &amp;quot;nihilism&amp;quot; has to do with the fact that HMAC-MD5 isn&amp;#x27;t broken. We didn&amp;#x27;t just &amp;quot;discover&amp;quot; that MD5 was weak; Paul Kocher knew it was weak when SSL 3.0 was standardized back in &lt;i&gt;1996&lt;/i&gt;, which is why the SSL 3.0 handshake PRF uses both SHA-1 and MD5.&lt;p&gt;Yours is the kind of comment anyone can write without knowing anything whatsoever about cryptography, so I&amp;#x27;m wary of going into more detail.</text></comment>
<story><title>Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010</title><url>http://op-co.de/blog/posts/android_ssl_downgrade/</url></story><parent_chain><item><author>echohack</author><text>On the contrary, &amp;quot;It has not been broken&amp;quot; is exactly what I would expect a programmer to say.&lt;p&gt;If the security of an algorithm is weakened, then it&amp;#x27;s important to evaluate the use of the algorithm and make efforts to implement stronger security &lt;i&gt;now&lt;/i&gt;. You should feel fortunate that you even get the time to move to something better before all hell breaks loose.&lt;p&gt;This is the same kind of thinking I hear daily when people say things like, &amp;quot;Just use bcrypt&amp;quot; without thinking about the consequences.&lt;p&gt;The tendency for programmers to think of security in a nihilistic way continues to boggle my mind. I don&amp;#x27;t think the article suffers from an alarmist tone. I think it&amp;#x27;s correct to look at something shitty and call it shit.</text></item><item><author>tptacek</author><text>There&amp;#x27;s interesting technical content here, but it suffers from its alarmist tone.&lt;p&gt;The MD5 hash function is broken, that is true. However, TLS doesn&amp;#x27;t use MD5 in its raw form; it uses variants of HMAC-MD5, which applies the hash function twice, with two different padding constants with high Hamming distances (put differently, it tries to synthesize two distinct hash functions, MD5-IPAD and MD5-OPAD, and apply them both). Nobody would recommend HMAC-MD5 for use in a new system, but it has not been broken.&lt;p&gt;RC4 is horribly broken, and is horribly broken in ways that are meaningful to TLS. But the magnitude of RC4&amp;#x27;s brokenness wasn&amp;#x27;t appreciated until last year, and up until then, RC4 was a common recommendation for resolving both the SSL3&amp;#x2F;TLS1.0 BEAST attack and the TLS &amp;quot;Lucky 13&amp;quot; M-t-E attack. That&amp;#x27;s because RC4 is the only widely-supported stream cipher in TLS. Moreover, RC4 was considered the most computationally efficient way to get TLS deployed, which 5-6 years ago might have been make-or-break for some TLS deployments.&lt;p&gt;You should worry about RC4 in TLS --- but not that much: the attack is noisy and extremely time consuming. You should not be alarmed by MD5 in TLS, although getting rid of it is one of many good reasons to drive adoption of TLS 1.2.</text></item></parent_chain><comment><author>Xylakant</author><text>&amp;gt; This is the same kind of thinking I hear daily when people say things like, &amp;quot;Just use bcrypt&amp;quot; without thinking about the consequences.&lt;p&gt;Sorry to say, but &amp;quot;just use bcrypt&amp;quot; is currently the right three word statement that you can use if anybody is asking &amp;quot;I&amp;#x27;d like to hash a password, and I don&amp;#x27;t want to learn all of crypto before I do.&amp;quot; Bcrypt is currently among the algorithms that are hard to break if used correctly, deployed widely, has wide support in deployed languages and frameworks and it&amp;#x27;s fairly simple to use. There&amp;#x27;s little room for major fuckups here.&lt;p&gt;There are algorithms that are harder to break (scrypt) or an official standard (PBKDF2), but seriously, bcrypt is currently good enough. Sure, it&amp;#x27;s always better to read and learn, but sometimes people just have to get things done and I&amp;#x27;d rather see them use bcrypt than sha1 or unsalted md5.</text></comment>