1. 1. MD5 weaknesses/Creating a rogue CA certificate

è The first article mostly talks about the weakness of MD5 hashing algorithm by giving a couple of examples that why MD5 is easy to break. The first example was Microsoft’s windows update. The flame espionage malware created a counterfeit certificate based on the same MD5 hash then computers starts to download malwares instead of updates using the legitimate credential. This is how it was easy to spread over millions computers using Windows operating system. Since then Microsoft started to use SHA1 instead but this is also believed to be broken in near future. Second example was stating that there were two images with one MD5 hash. This could be done by adding near collision blocks repeatedly until the two hashes become the same. This is the main flaw of MD5 which is MD5 collision. One reason that we need to pay attention to this problem is that this could be done within ten hours using Amazon Web Service paying only $0.65 plus tax. These …show more content…
Actually MD_Update(&m,buf,j); is the most important piece of code for generating random number in OpenSSL. By commenting out the line, we will only get 215(32,768) of random numbers which is too easy to figure out because you only need to try 32768 times then you will figure out what the random number is. So if an administrator simply commented out those two lines and then attacker found out that it would have only 32768 different cases. It is easy for attackers to get the information. If an attacker tried brute force attack, the attacker is able to acquire encrypted key so that it can be used to intercept the important information from the user. Long story short, attackers can predict information which is supposed to unpredictable. So if an attacker know this bug, he/she could have attacked based on OpenSSL because it was generated in two years ago. So if there are still some websites that did not update the bug, they need to do it