Re: Which password cipher ?

[Steven Bellovin <smb%cs.columbia.edu@localhost>]

On Dec 1, 2010, at 10:41 58AM, Thor Lancelot Simon wrote:

> On Wed, Dec 01, 2010 at 01:33:38PM +0000, Andrew Doran wrote:
>> 
>> Outside the NetBSD bubble most newly installed systems use MD5.
> 
> If that is actually the case, then it is not possible to certify such
> systems under most of the interesting/commercially valuable security
> standards.
> 
THat isn't clear to me -- the weakness under collision of MD5 is completely
irrelevant here.


                --Steve Bellovin, http://www.cs.columbia.edu/~smb