Version 17 of md5

Updated 2006-10-20 11:12:03 by suchenwi

Documentation can be found at http://tcllib.sourceforge.net/doc/md5.html


Anyone with some tips for the novice as to common uses for md5 and sha1?

DL - Here are some common uses for md5:

  • When distributing software, an md5 hash is computed and advertised alongside the published software. When the software is fetched, the user may recompute the md5 hash and compare it to the public md5 hash to have confidence that the downloaded distribution is indeed the one that was originally published.
  • The POP protocol can (as an option) avoid sending a plaintext password and instead send a hash of the password and the date. This protects the plaintext password from capture while still ensuring a high-level of authentication. You can see how this is coded in applications such as tkbiff.

md5 is older and more commonly used than sha1 but sha1 is considered more secure. However, for most purposes, md5 is good enough.

PT - SHA and MD5 are both enhanced digests based upon the MD4 algorithm. Although MD4 has not been broken - attacks have been demonstrated against the first two rounds and separately against the final round. The publication of these cryptanalytical attacks lead to a strengthend algorithm - MD5. See the sha1 page for details of how that has been sthrengthened. For MD5, the enahancements involve adding another round, adding a unique constant into each step, changing the round 2 function G to be less symmetrical. Each step now also includes the result of the previous step to speed up the avalanche effect. See [BOOK: Applied Cryptography pp 436].


Fast alternatives include mhtcl and ... a Critcl implementation in Critlib, see [L1 ].

The tcllib implementation provides a Tcl only MD5 but it will defer to the md5 from the Trf package if that is available.


Salvatore Sanfilippo: A pure TCL implementation is at http://expect.nist.gov/md5pure/


jmn 2004-02-01 Are there some gotchas the novice user should be aware of here? What happens when you use the binary value returned by md5::md5 as part of a string, as in the following snippet taken from Tuplespace

 proc tid {tuple} {
     return "\#Tuple[::md5::md5 $tuple]"
 }

See my comments about half way down that page. Basically it looks like md5::md5 of the string {hello there test etc} returns a value that includes a carriage return. As I guess can be seen by the existence of 0D when you look at the hex result:

 % md5 -hex {hello there test etc}
 FC7EB2BA07710DECECC688BCEA5BB323

I assume there may be other characters that may cause problems when using the binary result in a string - so presumably one should always use the -hex option for this sort of situation(?)

When and how does one use the binary result then?

PT You have turned the binary result into the string representation of a binary result there. If you want a string then you should use the -hex option or in some other way arrange to protect the data. For instance, once a string function is used any embedded nil chars are goign to terminate the data. The binary form is required if you are putting the result into a binary format -- for instance a network protocol or embedded into a file format.


RS 2006-10-20: Here's a little command line utility that returns the MD5 digest for one file, and, if specified, compares it with a second one:

 #!/usr/bin/env tclsh
 set usage {
    usage: md5.tcl filename ?filename2?
    prints the MD5 digest of the given file in hexadecimal to stdout.
    If filename2 is given, and its md5 digest differs from the first, 
    this is reported on stdout, and return code is 1. (If equal, 0).
 }
 if {[llength $argv]<1} {puts stderr $usage; exit}

 package require md5

 set md1 [md5::md5 -hex -file [lindex $argv 0]]
 puts $md1
 if {[lindex $argv 1] ne ""} {
    set md2 [md5::md5 -hex -file [lindex $argv 1]]
    if {$md1 ne $md2} {puts "*** unequal: $md2"; exit 1}
 }

Category Package, subset Tcllib, Category Cryptography