1. Chronology of MD5 Cryptanalysis
• 1996: Hans Dobbertin discovered collisions in MD5’s compression function.
• 2004: Xiaoyun Wang demonstrated practical full MD5 collisions in one hour on an IBM cluster.
• 2008: Security researchers generated a forged intermediate Certificate Authority (CA) certificate using chosen-prefix MD5 collisions, compromising all web browsers.
• 2012: The Flame cyberespionage malware used MD5 collisions to forge Microsoft Windows Update code-signing certificates.
2. Modern GPU Brute Force Speeds
Modern consumer graphics cards (like an RTX 4090) can compute over 100 billion MD5 hashes per second. Unsalted and weakly salted MD5 passwords can be cracked in minutes with precomputed rainbow tables.