I’m not going to evaluate if MD5 is safe for “tcpauth” even if I was competent enough to do so.
If confidentiality isn’t a factor (since any hush function that is fast m enough to brute force isn’t going to be particularly secure) and if integrity cannot be compromised through collisions then the hash function is safe for this usecase.
Why use MD5? It’s relatively easy to implement securely m, there are a lot of safe implementations and it’s fast.
No, "why use MD5" is because MD5 is the only one supported by kernels. And it has to be supported by kernels in order to allow any realistic use of a BGP daemon.
I thought this should be clear from the fact that it protects against RST packets. Nothing on an application layer can do that.
I wish I could edit that comment because while I expected people to go "oh, I didn't know TCP had that!", multiple commenters seem to have not read past "MD5" and assumed that this is pure application-level.
% for i in md5 sha1 sha256 sha512; do echo -n "$i: "; time ${i}sum test.bin > /dev/null ; done
md5: ${i}sum test.bin > /dev/null 1.37s user 0.13s system 99% cpu 1.501 total
sha1: ${i}sum test.bin > /dev/null 1.84s user 0.12s system 99% cpu 1.952 total
sha256: ${i}sum test.bin > /dev/null 4.43s user 0.16s system 99% cpu 4.593 total
sha512: ${i}sum test.bin > /dev/null 2.69s user 0.12s system 99% cpu 2.810 total
Surprisingly, SHA256 is much slower than SHA512 here.
If confidentiality isn’t a factor (since any hush function that is fast m enough to brute force isn’t going to be particularly secure) and if integrity cannot be compromised through collisions then the hash function is safe for this usecase.
Why use MD5? It’s relatively easy to implement securely m, there are a lot of safe implementations and it’s fast.
This is why CRC32 is still used today also.