HashesBroken
Message Digest 5
Cryptographic hash function (obsolete)
How it works
MD5 processes input in 512-bit blocks through a Merkle-Damgard construction and outputs a 128-bit digest. Practical collision attacks were published in 2004, and chosen-prefix collisions followed. It remains common as a non-security checksum.
Sizes: 128-bit output
Status: Collisions can be generated quickly; unsafe for any security purpose.
Strengths
- Fast; still fine for detecting accidental corruption where no attacker is involved
Weaknesses and known attacks
- Collisions: two different inputs with the same hash can be produced on ordinary hardware.
- Chosen-prefix collisions were used to forge a rogue CA certificate (2008) and by the Flame malware to fake Microsoft code signing (2012).
- Length extension attacks, as with other Merkle-Damgard hashes.
- Far too fast for password storage.
Use it for
- Non-security checksums and deduplication
Don't use it for
- Signatures, certificates, integrity against attackers, password storage
Exam tip
MD5 = 128-bit and broken by collisions. If a question asks which hash should never be used for certificates or signatures, MD5 and SHA-1 are the answers.