Skip to content

Instantly share code, notes, and snippets.

@GUIEEN
Last active September 23, 2019 10:39
Show Gist options
  • Select an option

  • Save GUIEEN/ab86042a4a8f7bdcde04f1321e3b5ee5 to your computer and use it in GitHub Desktop.

Select an option

Save GUIEEN/ab86042a4a8f7bdcde04f1321e3b5ee5 to your computer and use it in GitHub Desktop.
md5

Add salt at the end of the string when you're using md5

hash = md5(salt + 'xyzzy')

hash = md5('xyzzy' + salt)

Reason.

mind: point taken about md5 being 'good enough' for your purposes. yes, sha1 is cryptographically broken, move to sha512/sha256 ("sha2").

however i will add.. your handwaving example of using

hash = md5(s . 'xyzzy')

to overcome a malicious party who wants to cause collisions is not going to work. appending the same thing to two messages that hash the same will yield two new messages that hash the same. in fact, this is what makes it so easy to create arbitrary messages which hash to the same thing (it does not require a "sophisticated attacker" at all)

Isn't MD5 overkill?

Folks sometimes say MD5 is "overkill" for a lot of these applications. But it's good, cheap, strong, and it works. It's not going to cause you problems if you use it. You're not going to ever have to debug it or second guess it. If you have perf problems, and suspect MD5, and then go profile your code, it's not going to be MD5 that's causing your problems. You're going to find that it was something else.

But if you feel you absolutely must leave the path and look for some faster hashes, check out Bob Jenkins' site. [Also see the Hsieh hash, it looks very good.]

How fast is MD5?

About as fast as your disk or network transfer rate.

Algorithm	Size	MB/s
MD4	128	165.0
MD5	128	98.8
SHA-1	160	58.9

These are 2004 numbers from the perl Digest implementation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment