Is it safe to initialize a random number generator with MD5?

Begoña Garcia

10/20/23, 2:30 PM

The MD5 algorithm is no longer considered secure for most applications of a hash algorithm. However, is it safe to initialize a PRNG via a password?

If it is not, how could it be exploited?

239

1 + 3

cryptanalysis

password-hashing

kelalaka

10/20/23, 3:17 PM

Could you define how do you use MD5 for each instantiation of the RNG

Begoña Garcia

10/21/23, 5:11 AM

I'm studying a steganography application where MD5(password) is used to initialize a PRNG that selects the pixels of an image to hide information on. The accepted answer does not apply to my case, but it is correct considering that my question is not complete. I will open another question for this.

kelalaka

10/21/23, 9:27 AM

This is why you should mention all details to that you took the time of other more carefully. People, here, want to help, however, their time is valuable.

Score:4

Crypto

fgrieu

10/20/23, 3:38 PM

No, it is not safe to initialize a (CS)PRNG with the MD5 hash of a password.

That's not so much an issue with MD5 as it is an issue with initializing a PRNG with a function of a password that can be computed fast. SHA-256 would be nearly as bad. When turning a password into a key/seed, we need to use key/entropy stretching, and towards this use a memory-hard function such as Argon2, with reasonable parameters. Otherwise, we risk being very vulnerable to password cracking.

Also, inasmuch as possible, an input of the function should include salt (such as a username, email, filename).

how could it be exploited?

The attacker would hash a dictionary of common passwords, and for each initialize the PRNG with the result, produce some PRNG output, and test if that output is correct. That test depends on the usage of the PRNG. For example, if the PRNG is used as a stream generator for a stream cipher, and a known plaintext/ciphertext pair is available, the test boils down to comparing the PRNG output to the XOR of plaintext and ciphertext over an appropriate length. If only ciphertext is available, but correct plaintext is recognizable (e.g is highly redundant), an attack is still possible.

+ 1

kelalaka

10/20/23, 4:30 PM

That is really depend on the strength of the password. One can use password with strength 256-bit to be on the safe side regardless of the password hashing algorithm and their parameters.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Is it safe to initialize a random number generator with MD5?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.