From: Craig Wright (cwright@bdosyd.com.au)
Date: Thu Sep 22 2005 - 23:52:50 EDT
First the quote from the MSFT program manager
"Microsoft is banning certain cryptographic functions from new computer
code, citing increasingly sophisticated attacks that make them less
secure, according to a company executive. The Redmond, Wash., software
company instituted a new policy for all developers that bans functions
using the DES, MD4, MD5 and, in some cases, the SHA1 encryption
algorithm, which is becoming "creaky at the edges," said Michael Howard,
senior security program manager at the company, Howard said."
"All three algorithms show signs of 'extreme weakness' and have been
banned, Howard said. Microsoft is recommending using the Secure Hash
Algorithm (SHA)256 encryption algorithm and AES (Advanced Encryption
Standard) cipher instead, he said.
Quote when hearing about this
"It's about time," Bruce Schneier of Counterpane Security Inc "Microsoft
should
have ended use of DES, MD4 and MD5 years ago"
To answer "And I'm not sure where you are getting your info regarding
Microsoft "dropping NTLMv2 for backward compatibility.""...
Don't take my word for it...
http://www.eweek.com/article2/0%2C1895%2C1859751%2C00.asp
http://www.neowin.net/comments.php?id=30463&category=main
http://www.technorati.com/search/md5
http://www.extremetech.com/article2/0,1697,1859953,00.asp
http://it.slashdot.org/article.pl?sid=05/09/16/1211227&from=rss
http://diswww.mit.edu/bloom-picayune/crypto/18482
http://www.codeproject.com/useritems/GoodbyeMD5.asp
http://forums.thetechzone.com/showthread.php?s=&threadid=76038
http://download.microsoft.com/download/b/8/3/b838ee36-41a2-4280-af5c-182
04bb7a581/cryptography_windows_vista_2005_MBR.wmv
Complimentary
http://www.microsoft.com/presspass/features/2002/jan02/01-24secure.mspx
For those who still believe MD5 collisions are just theory
http://www.codeproject.com/useritems/HackingMd5.asp
Craig
PS NTLMv2 uses MD4 and HMAC_MD5 - these are not going to be supported.
MSFT is moving to AES and SHA256 - so I guess it might be time for some
people still on Windows 98 or NT 4.0 to finally move on.
------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:
Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:59 EDT