A Chinese Cryptographer Broke MD5, MD4, and Two Other Hash Functions in One Day in 2004. Here Is What Happened Next.

The Hash Function Lineage

Understanding how MD5 came to be the internet standard requires knowing the genealogy of cryptographic hash functions.

Ralph Merkle and Martin Hellman, co-inventors of public-key cryptography, described the requirements for secure hash functions in the late 1970s. Ron Rivest, the R in RSA, designed MD4 in 1990 and MD5 in 1992 as improvements over earlier work. MD stands for Message Digest, and the function was explicitly designed for computing message authentication codes and digital signatures.

SHA, the Secure Hash Algorithm, was developed by the National Security Agency and published by NIST in 1993. SHA-0 was revised to SHA-1 in 1995 after a flaw was found in the original. SHA-1 produces 160-bit digests and was widely adopted as the successor to MD5. In 2005, Wang's team also demonstrated attacks on SHA-1, showing that collisions were theoretically findable with far less computational effort than the 2^80 operations that a fully secure 160-bit function would require. Google's Project Zero and CWI Amsterdam produced the first practical SHA-1 collision, two different PDF files with the same SHA-1 hash, on February 23, 2017.

NIST published the SHA-2 family in 2001: SHA-256, SHA-384, and SHA-512. These functions have not been broken by collision attacks and remain NIST-recommended for security applications. In 2012, NIST selected Keccak as the SHA-3 standard after a five-year public competition specifically designed to produce a hash function with a different mathematical design from SHA-2, providing a hedge against future cryptanalysis.

What Hash Functions Actually Do

A cryptographic hash function takes an input of any length and produces a fixed-length output called a digest. The output length depends on the algorithm: MD5 produces 128 bits (displayed as 32 hexadecimal characters), SHA-1 produces 160 bits (40 hex characters), SHA-256 produces 256 bits (64 hex characters), SHA-512 produces 512 bits (128 hex characters).

The properties that make hash functions useful are:

Determinism: the same input always produces the same output. Hash functions are stateless and reproducible, which is what makes them useful for verification.

Preimage resistance: given a hash output, you cannot computationally find any input that produces it. This is the "one-way" property.

Avalanche effect: changing one bit in the input changes approximately half the bits in the output. This ensures that similar inputs produce completely different hashes.

Collision resistance: it should be computationally infeasible to find two different inputs that produce the same output. This is the property that Wang's attacks broke for MD5 and eventually SHA-1.

Fast computation: hash functions are designed to be computationally efficient so that verifying a file or computing a signature is fast. This speed property is both useful for verification and problematic for password storage, as discussed below.

Which Uses Are Now Safe and Which Are Not

The compromised collision resistance of MD5 matters for specific use cases and not others.

For digital signatures, certificates, and any use where an attacker might craft a malicious input matching a legitimate hash, MD5 is unusable and SHA-1 is deprecated. Major browsers stopped accepting SHA-1 certificates in 2017. NIST deprecated SHA-1 for digital signature applications in 2011 and disallowed its use entirely in federal information systems from 2014 onward.

For simple file integrity checksums where you are verifying that a file downloaded correctly and where the person providing the hash is trusted, MD5's collision weakness is less directly relevant. An attacker would need to create a malicious file that collides with the original file's MD5 hash, which is a more complex operation than simply finding a collision between two files they control. In practice, most infrastructure has moved to SHA-256 for all new use cases because the security margin is substantially higher and the cost of changing is minimal.

For forensic evidence hashing, MD5 and SHA-1 are still routinely used in practice, though SHA-256 has become the standard in more recent guidance. The digital forensics community uses hash values to verify that evidence files have not been altered, and the evidentiary integrity function is served by any hash function that is unlikely to produce collisions by accident. The weakness is against intentional crafted collisions, which differs from accidental collision.

Password Storage: A Different Problem

Password hashing is fundamentally different from file hashing, and using SHA-256 or any fast general-purpose hash for password storage is an error that creates serious security risk.

Fast hash functions process billions of inputs per second on modern hardware. An attacker who obtains a database of hashed passwords can attempt billions of password guesses per second against each hash, trying common passwords, dictionary words, and variations. With a fast hash like SHA-256, a comprehensive password guess effort against a leaked database is a matter of hours.

Password storage requires hash functions specifically designed to be slow. Bcrypt, published in 1999 by Niels Provos and David Mazieres, includes a work factor that can be increased as hardware improves, making brute-force attacks expensive. Scrypt, published in 2009 by Colin Percival, adds memory-hardness to make attacks on specialized hardware more difficult. Argon2, which won the Password Hashing Competition in 2015, combines time and memory hardness and is NIST's current recommendation for password hashing.

The distinction is not about the security of SHA-256 in general. SHA-256 is secure for its intended uses. Password hashing requires a different property, resistance to high-speed guessing, which general-purpose fast hashes are not designed to provide.

Verifying Files with Hash Values

The most common everyday use of hash functions is verifying file integrity. When you download large software, operating system images, or any file where corruption or tampering is a concern, the source typically publishes the SHA-256 hash alongside the download link. After downloading, you compute the hash of your local copy and compare it to the published value.

This operation is exactly what cryptographic hash functions were designed for. The comparison is a single equality check: the hash of your file either matches the published hash or it does not. A mismatch means either corruption during download or tampering. A match means byte-for-byte integrity relative to the file the source had when they computed the hash.

Conclusion

ToolHQ's hash generator computes MD5, SHA-1, SHA-256, and SHA-512 hashes for any text input. For file integrity verification, paste the file content or compare hashes of specific strings. For understanding how different hash functions compare, compute the same input with multiple algorithms to see how the digest length and format differ.

The story of hash function security is ongoing. SHA-2 has remained secure, but the existence of SHA-3 as a backup with a different mathematical foundation reflects that the cryptography community does not assume any single design is permanently safe. The lesson from Wang's 2004 announcement is that hash functions that were thought unbreakable were not. Planning security systems with that lesson in mind means preferring algorithms with larger security margins and being prepared to migrate when necessary.

Frequently Asked Questions

Try These Free Tools