MD5 (Message Digest 5)

Overview

MD5 (Message Digest 5) is a widely-used cryptographic hash function that produces a 128-bit hash value. Designed by Ronald Rivest in 1991, MD5 was commonly used for data integrity verification and password hashing.

However, MD5 is now considered cryptographically broken and unsuitable for security purposes. Collision attacks can be performed in seconds, making it vulnerable to various security threats. MD5 should not be used for any security-critical applications.

How It Works

MD5 processes input in 512-bit blocks:

  1. Padding: Add padding to make length multiple of 512 bits
  2. Append Length: Add original message length
  3. Initialize State: Set initial hash values
  4. Process Blocks: Apply compression function to each block
  5. Output: Produce 128-bit hash value

Implementation


import hashlib

def md5_hash(data):
    """Compute MD5 hash"""
    return hashlib.md5(data.encode()).hexdigest()

# Example usage
message = "Hello, MD5!"
hash_value = md5_hash(message)
print(f"MD5 Hash: {hash_value}")

# Note: MD5 should NOT be used for security purposes
# Use SHA-256 or SHA-512 instead

Specifications

  • Output Size: 128 bits (16 bytes)
  • Block Size: 512 bits
  • Rounds: 4 rounds of 16 operations (64 steps total)
  • Status: Cryptographically broken

Security Issues

MD5 has serious security vulnerabilities:

  • Collision resistance: completely broken. Two different inputs with the same hash can be produced in seconds on a laptop. Chosen-prefix collisions are also practical, which is what enabled the forged Microsoft code-signing certificate used by the Flame malware in 2012.
  • Pre-image resistance: not broken in practice. The best known pre-image attack is Sasaki & Aoki (2009) at 2123.4 operations — faster than the 2128 generic bound, but entirely infeasible. Given only a hash, you still cannot recover an input.
  • Consequence: MD5 is fatal anywhere an adversary can influence the input — signatures, certificates, deduplication, integrity checks against tampering. It is merely inadvisable where no adversary exists.

MD5 collisions were first demonstrated by Wang et al. in 2004. The distinction above matters: MD5 is broken for collision resistance, not for pre-image resistance, and conflating the two leads people to the wrong conclusions about which legacy uses are actually dangerous.

When to Use MD5

Do NOT use MD5 for security purposes. It may only be used for:

  • Non-security checksums (file integrity in non-adversarial environments)
  • Legacy system compatibility
  • Educational purposes

For security applications, always use SHA-256 or SHA-512 instead.

Secure Alternatives

  • SHA-256: Recommended for most applications
  • SHA-512: For high-security requirements
  • BLAKE3: Modern, very fast, parallelizable (BLAKE2 is its widely-deployed predecessor)
  • SHA-3 / SHAKE: Sponge construction, immune to length extension
  • Argon2id: For password hashing — never use a general-purpose hash for this

Related Algorithms

Explore other encryption algorithms: