A View from Erika Jonietz

Cryptographers Find New Weaknesses in Common Security Algorithms

More fodder for the computer security paranoid: Computer scientists have reported previously unknown flaws in three key mathematical functions embedded in common security applications at this week’s Crypto 2004 conference in Santa Barbara, CA.Both Chinese and French researchers reported weaknesses…

  • August 18, 2004

More fodder for the computer security paranoid: Computer scientists have reported previously unknown flaws in three key mathematical functions embedded in common security applications at this week’s Crypto 2004 conference in Santa Barbara, CA.

Both Chinese and French researchers reported weaknesses in a popular algorithm called MD5, often used with digital signatures. Then Eli Biham of the Technion Institute in Israel reported some early work toward identifying vulnerabilities in the SHA-1 “Secure Hash Algorithm,” which was believed to be secure. The news was reported here on CNET News.

While the results are all preliminary, intruders could eventually use them to insert “back doors” into computer code or to forge electronic signatures.

(Simson Garfinkel recently wrote a nice explanation of hash functions in a column titled “Fingerprint Your Files.”)

The SHA-1 algorithm is currently considered the gold standard hash algorithms and is embedded in popular security programs like PGP (used to encrypt e-mail) and SSL (used to secure Web transactions). The National Institute of Standards and Technology has certified it, and it’s the only signing algorithm approved for use in the U.S. government’s Digital Signature Standard.

Seems like it’s time for mathematicians and computer scientists to start working on the next-next generation of security algorithms.

Uh oh–you've read all of your free articles for this month.

Insider Premium
$179.95/yr US PRICE

Want more award-winning journalism? Subscribe to Insider Premium.
  • Insider Premium {! insider.prices.premium !}*

    {! insider.display.menuOptionsLabel !}

    Our award winning magazine, unlimited access to our story archive, special discounts to MIT Technology Review Events, and exclusive content.

    See details+

    What's Included

    Bimonthly magazine delivery and unlimited 24/7 access to MIT Technology Review’s website

    The Download: our daily newsletter of what's important in technology and innovation

    Access to the magazine PDF archive—thousands of articles going back to 1899 at your fingertips

    Special discounts to select partner offerings

    Discount to MIT Technology Review events

    Ad-free web experience

    First Look: exclusive early access to important stories, before they’re available to anyone else

    Insider Conversations: listen in on in-depth calls between our editors and today’s thought leaders

/
You've read all of your free articles this month. This is your last free article this month. You've read of free articles this month. or  for unlimited online access.