Page 556 - StudyBook.pdf

540 Chapter 9 • Basis of Cryptography

mathematical process used to obtain the hash value. Let’s take a quick look at the
hashing algorithms you are likely to encounter on the Security+ exam:

■ Message Digest 4/Message Digest 5 (MD4/MD5) The message
digest (MD) class of algorithms were developed by Ron Rivest for use
with digital signatures.They both have a fixed 128-bit hash length, but the
MD4 algorithm is flawed and the MD5 hash has been adopted as its
replacement.

■ Secure Hash Algorithm (SHA) This hashing algorithm was created by
the U.S. government (NIST and the National Security Agency [NSA])
and operates similarly to the MD algorithms.The most common is SHA-
1, which is typically used in IPSec installations, and has a fixed hash length
of 160 bits.There are other forms of the SHA algorithm that have dif-
ferent hash lengths, but they are unlikely to be encountered on the
Security+ exam.

Using MD5 for Data Integrity
Tools and Traps… a Trojan horse. The software itself was not trojaned, only the distribution
A few years ago, MD5 sums were used to verify that a distribution of
OpenSSH, the popular open source SSH software, had been infected with

files. Because certain operating systems such as FreeBSD automatically
check MD5 sums of downloaded source against known MD5 sums of
what the package should be, the trojaned files were discovered and
removed from the distribution source within six hours of the infection.

www.syngress.com