Zombie cryptography

I spend a lot of time convincing people to undertake cryptographic discovery and inventory as the first step in post-quantum migration, a response to the coming of quantum computers that once felt like a science fiction movie. There are other reasons to do discovery and inventory though. One in particular reminds me of a different genre of movie: horror movies full of the living dead.

Legacy: tales from the crypt

When you hear people talk about the history of the Internet, they tend to talk about its evolution. Evolution is a process that adapts to the current environment rather than one that plans for the future. As the Internet changed, it had to cope with vestigial, outdated choices to maintain “backward compatibility” before considering the challenges of forward compatibility. These days all understand the importance of cryptographic agility, but this provides a plan for the future rather than helping us deal with the problems of old protocol versions and deprecated cryptographic primitives. Let us consider a bad example of how to stop using legacy methods.

MD5 a horror from beyond the grave

The MD5 hash function is a cryptographic building block from the early days of the Internet. It was designed in 1991 and adopted by the Internet Engineering Task Force (IETF) in 1992. This is a relatively short time to modern eyes and within a few years questions were raised about the security of the design. By 2004, a team led by Xiaoyun Wang were able to practically show that MD5’s security targets were not being met. The research was ingenious but did not immediately demonstrate a practical attack on the Internet, and people were not motivated to remove MD5 from use. Then in 2005 Wang, Lenstra and de Weger showed that a practical attack on the Internet was possible by using MD5 to create a forged certificate. Although advisory groups acknowledge this serious vulnerability, MD5 proved harder to remove from use than it had been to adopt. Although experts had already declared that MD5 was “broken and unsuitable for further use” in 2008, the IETF only declared MD5 unsuitable for certain applications in 2011. Usage persisted however and in 2012 it was shown that MD5’s weakness had enabled the Flame malware to avoid detection. Although efforts to remove MD5 and disallow its usage ramped up, it proved hard to eradicate. As recently as 2024, the use of MD5 in the RADIUS protocol for auditing networked devices was shown to be real-time vulnerable to the Blast-RADIUS attack. Twenty years after the revelation of practical attacks, MD5 lurches on.

What’s hiding under your bed as you sleep?

As we at Arqit undertake commissions to discover and inventory organizations’ current use of cryptography using our Encryption Intelligence tool, it would be nice to report that such occurrences are a thing of the past. However, we find that many Internet links are still using deprecated protocols and legacy cryptography because migration is hard, particularly for embedded systems or products no longer under support. We still see instances of MD5 and other vulnerable forms of cryptography that go against the advice of all reputable advisory groups. We find that the network owners were not aware of this risk.

These horror stories not only make me fear for the time it will take to eradicate quantum vulnerable cryptography from systems; they make me fear for the safety of networks today.