Uma das apresentações do SSI que mais me assustaram foi a realizada pelo Paulo Barreto, da USP, sobre "A crise das funções de Hash", relatando os últimos resultados obtidos nas tentativas (e conquistas) e quebra das funções de hash.
Um artigo interessante que apresenta um resumo sobre esta questão está em http://software.newsforge.com/article.pl?sid=05/11/02/2056250&from=rss.
As conclusões finais do artigo são bem claras e corretas: "If you're developing something today, do it with SHA256. Better yet, implement your new application to be "algorithm agile," meaning plan for the reality that crypto algorithms have a relatively short lifespan and the algorithm you start with will likely become insecure before your application becomes obsolete. For existing systems the guidance was extended: If you have legacy systems running SHA1, start working on a strategy to change them out over the next few years. And if you still have systems running MD5, run for the hills, because the sky has already fallen."
Disclaimer: The views expressed on this blog are my own and do not necessarily reflect the views of my employee.
Nenhum comentário:
Postar um comentário