md5 encryption

[activee]

Hi,

so it's not really a coding question but md5 got me a bit worried. I just learned about it and I was wondering what would stop someone to create a table with each encryption possibe from 0 to 15 characters and save it in a table.  Then if he finds a md5-encrypted password he can then translate it via his table assuming that the original password  is 15 characters or less. Is that right ? that freaks me out a bit tbh.

Edited August 9, 2013 by activee

[Muddy_Funster]

Easiest way - don't use MD5.  Rainbow tables are readily available for this and the lower level SHA encryptions as well.  Even with MD5, you should always apply a SALT to whatever you are hashing, a good SALT will increase the security of any hash significantly.

[kicken]

Read through this thread: How to safely store passwords for some details about hashing, rainbow tables, salts, etc. That should give you a lot of good info to start with. The short answer to your questions though:

what would stop someone to create a table with each encryption possibe from 0 to 15 characters and save it in a table.

Then if he finds a md5-encrypted password he can then translate it via his table assuming that the original password  is 15 characters or less. Is that right?

The value found may or may not be the original password, but if it results in the same hash then it will work just as well. Two values resulting in the same hash is possible, and is known as a collision.

 

On a side note, MD5 is not encryption, it is a hash. Something that has been encrypted can be readily decrypted. That is not possible with MD5 and other hashing algorithms. As such, do not reference things as being MD5-encrypted, use md5-hashed or similar.

[Muddy_Funster]

Actualy, the act of encrypting is just the application of a crytographic function to a message  in order to create a digest - of which hashing is a "one way" example of this.  So the use of encryption to describe one way hashing isn't strictly innacurate.

[requinix]

what would stop someone to create a table with each encryption possibe from 0 to 15 characters and save it in a table

The astronomical number of possibilities. (Thus rainbow tables.)