md5

MD5 is a historical message-digest algorithm.

See Also

blake3

A fast, secure alternative

sha2

Secure, widely supported alternatives: SHA-224, SHA-256, SHA-384, and SHA-512

Tcllib MD5

Tcllib implementation

critlib

includes an MD5 implementation in C

MHTCL

a C extension for Tcl that implements an interface to MHASH

Trf

includes an MD5 implementation in C

MD5Pure

A pure-Tcl implementation of MD5, for small strings

Documentation

RFC Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms , 2011-03

RFC 1321 , The MD5 Message-Digest Algorithm, 1992-04

Description

Anyone with some tips for the novice as to common uses for md5 and sha1?

DL: Here are some common uses for md5:

• When distributing software, an md5 hash is computed and advertised alongside the published software. When the software is fetched, the user may recompute the md5 hash and compare it to the public md5 hash to have confidence that the downloaded distribution is indeed the one that was originally published.
• The POP protocol can (as an option) avoid sending a plaintext password and instead send a hash of the password and the date. This protects the plaintext password from capture while still ensuring a high-level of authentication. You can see how this is coded in applications such as tkbiff.

md5 is older and more commonly used than sha1 but sha1 is considered more secure. However, for most purposes, md5 is good enough.

PT - SHA and MD5 are both enhanced digests based upon the MD4 algorithm. Although MD4 has not been broken - attacks have been demonstrated against the first two rounds and separately against the final round. The publication of these cryptanalytic attacks lead to a strengthened algorithm - MD5. See the sha1 page for details of how that has been strengthened. For MD5, the enhancements involve adding another round, adding a unique constant into each step, changing the round 2 function G to be less symmetrical. Each step now also includes the result of the previous step to speed up the avalanche effect. See [BOOK: Applied Cryptography pp 436].

Misc

RS 2006-10-20: Here's a little command line utility that returns the MD5 digest for one file, and, if specified, compares it with a second one:

#!/usr/bin/env tclsh
set usage {
    usage: md5.tcl filename ?filename2?
    prints the MD5 digest of the given file in hexadecimal to stdout.
    If filename2 is given, and its md5 digest differs from the first, 
    this is reported on stdout, and return code is 1. (If equal, 0).
}
if {[llength $argv] < 1} {puts stderr $usage; exit}

package require md5

set md1 [md5::md5 -hex -file [lindex $argv 0]]
puts $md1
if {[lindex $argv 1] ne {}} {
    set md2 [md5::md5 -hex -file [lindex $argv 1]]
    if {$md1 ne $md2} {puts "*** unequal: $md2"; exit 1}
}

DcK 2010-10-14: Here how to get an hexadecimal MD5 command on several platforms:

#Gets MD5 hash
proc md5 {string} {
    #tcllib way:
    package require md5
    string tolower [::md5::md5 -hex $string]

    #BSD way:
    #exec -- md5 -q -s $string

    #Linux way:
    #exec -- echo -n $string | md5sum | sed "s/\ *-/\ \ /"

    #Solaris way:
    #lindex [exec -- echo -n $string | md5sum] 0

    #OpenSSL way:
    #exec -- echo -n $string | openssl md5
}

MJ - See [L1 ] for a version of md5 implemented using tcc4tcl.