Cryptography is becoming a widely searched field for the general public, although it’s been around for ages in the computer science industry.

This popularity is likely thanks to the rise of blockchain technology and the term “cryptocurrency”. One of the fundamental algorithms in cryptography is the Message-Digest Algorithm 5, better known as the MD5 hash.  

What is the MD5 Hash?

---

The MD5 hash is a cryptographic hash algorithm that was built from its predecessor, the MD4.  

This algorithm takes a string of any length and turns it into a 128-bit hash value that is then often displayed as a 32-digit hexadecimal number. While the MD5 hash has been shown to have some vulnerabilities, it is still widely used. Previously, it was used in applications like SSL and SSHL. Now, it’s most often utilized to verify the integrity of files. Additionally, it can aid in non-cryptographic functions

Some application developers who use MD5 may choose to strengthen the algorithm with an additional salt value. Alternatively, some applications make use of the hash several times to strengthen the security.

The MD5 Algorithm

---

To start, it’s crucial to know that the MD5 algorithm uses blocks of 512 bits. These bits are then broken down into 16 different 32-bit words.

The first step in the process is to take the message—the string which we want to hash—and pad it, so the length of the message is 448 bits.

The reason it’s padded to 448 bits is to leave 64 bits extra of 512. There will always be some padding added, so the result is always congruent to 448, modulo 512.

Once the padding is finished, the 64-bits are added to produce a 512-bit message. This message is as described above—16 words of 32-bits.

Next, the algorithm takes the four words, indicated as ABCD, to process the message block. According to the RFC 1321, the four words utilize the following hexadecimal values and auxiliary functions.

Values

A: 01 23 45 67

B: 89 ab cd ef

C: fe dc ba 98

D:  76 54 32 210

Functions

F(X,Y,Z) = XY v not(X) Z

G(X,Y,Z) = XZ v Y not(Z)

H(X,Y,Z) = X xor Y xor Z

I(X,Y,Z) = Y xor (X v not(Z))

The four functions will take 3 out of the 16 32-bit words, and they will each produce one 32-bit word.

From there, the algorithm does what is shown in the image here. The implementation in the image is shown in C.

MD5 versus MD4

---

As MD5 is based on MD4 there are several obvious similarities such as the use of padding bits and compression to produce a secure 128-bit message.

Regardless of the similarities, there are still key differences between MD5 and MD4.

1. The MD5 algorithm uses a unique constant T[i] (as shown in the image) in each round. On the other hand, the MD4 algorithm uses a fixed constant.
2. MD5 has four rounds which in turn creates 64 steps of compression. MD4 only uses 3 rounds which corresponds to 48 steps.
3. In the 2^nd round of compression, the function G was changed to make G less symmetric.
4. In MD5, upon completion of the next step, the results of the previous and current steps are added. The goal of this addition is to cause the avalanche effect to occur faster.
5. In MD5, in the 2^nd and 3^rd rounds, the input words are accessed differently to randomize the pattern.
6. The ultimate shift amounts have been optimized to further increase the onset of the avalanche effect.

As the MD5 algorithm utilizes 4 rounds, rather than 3 like MD4, the process is slightly slower. However, this was intended as it would theoretically make MD5 more secure than MD4. Unfortunately, there have still been documented security issues with MD5. For instance, the algorithm has been proved to not be collision-resistant—two inputs can have the same output hash which is a critical failure of the algorithm.

In 2010, Carnegie Mellon University announced that the MD5 algorithm was cryptographically broken. And while this is widely known in the public, as of 2019, several content management systems persist in using MD5 as the default hashing scheme for password storage.  

If you’re worried about your online privacy and the fact that CMS systems may be storing your passwords using a compromised cryptography algorithm, you’re like millions of others all around the world. Visit Privacy Canada to learn more about internet security and how you can protect yourself!

You Might Also Like

• Best VPN Services in Canada (2021)
• Online Privacy: 11 Ways To Protect Yourself in 2021
• Most-Effective Ad Blockers
• Affine Cipher