MD5

MD5 (for Message Digest Algorithm 5) is a hash function used to produce a unique digital fingerprint for a piece of data (such as a password or a file).

This fingerprint therefore makes it possible to identify the initial data, which is very practical in computer science and cryptography.

MD5 is also the name given to the fingerprint (result of this hash function), it is generally represented as a series of 32 hexadecimal characters (128 bits).

MD5 hash calculates from binary data a numeric footprint of 128 bits. The algorithm uses nonlinear function, here are the 4 main ones:

$$ F(B,C,D) = (B\wedge{C}) \vee (\neg{B} \wedge{D}) $$

$$ G(B,C,D) = (B\wedge{D}) \vee (C \wedge \neg{D}) $$

$$ H(B,C,D) = B \oplus C \oplus D $$

$$ I(B,C,D) = C \oplus (B \vee \neg{D}) $$

The MD5 is based on non-linear and unidirectional functions (therefore non-reversible), so there is no reverse decryption method md5decrypt().

However, a stupid and brute method, the most basic but also the longest and most costly method, is to test one by one all the possible words in a given dictionary to check if their fingerprint is the matching one.

dCode uses its databases of words (2 million potential passwords) whose MD5 hash has already been pre-calculated. These tables are called rainbow tables.

The hash is composed of 32 hexadecimal characters 0123456789abcdef, so 128 bits.

The characters are close to random, therefore unpredictable with high entropy.

MD5 is used for file integrity verification, creating digital signatures, and in certain security protocols.

However, its use is now discouraged for the security of sensitive data such as passwords.

Statistically speaking, for any string (and there is an infinite number), the MD5 associates for a given value a 128-bit fingerprint (a finite number of possibilities). It is therefore mandatory that there are collisions (2 strings with the same hash). Several research works on the subject have demonstrated that the MD5 algorithm, although creating a large entropy of data, could be attacked, and that it was possible to generate chains with the same fingerprints (after several hours of neat calculations).

Since this publication in 2005, MD5 encryption is no longer considered cryptographically, giving way to its successors: SHA1 then SHA256.

The MD5 is threatened by the growing computing capabilities of supercomputers and processors capable of parallelizing hash functions. Thus, to complicate the search by the rainbow tables (passwords databases), it is recommended to add salt (a prefix or a suffix) to the password. With this salting step, the precalculated tables must be calculated again to take account of the salt which systematically modifies all the fingerprints.

Another variant is the application of DOUBLE MD5, which consists in applying the hash algorithm twice.

MD5 is not the only hash function, it also exists SHA1, SHA256, SHA512 etc.

MD5 stands for Message Digest 5, referring to its function of obtaining a summary (digest) of messages.

The PHP language has a default functionality: the type juggling which allows to not define the type of variable used, the PHP engine tries to automatically detect if the variable is a string, an integer, etc.

However this functionality can become a flaw when handling MD5 string whose value has the form 0e followed by digits between 0 and 9. Indeed, in this case, the PHP engine will convert the string into a floating number having the value 0.

Here is a list of magic MD5 hashes:

Bonus strings that can also be evaluated at 0: 0e215962017, 0e730083352, 0e807097110, 0e840922711

The MD5 was invented by Ronald Rivest in 1991 to replace its predecessor, MD4.