'''[http://www.rfc-editor.org/info/rfc6151%|%MD5]''' is a message-digest
algorithm. 


** See Also **

   [Tcllib MD5]:   

   [critlib]:   includes an MD5 implementation in [C]

   [MHTCL]:   a [C] extension for Tcl that implements an interface to MHASH

   [Trf]:   includes an MD5 implementation in [C]

   [MD5Pure]:   A pure-Tcl implementation of MD5, for small strings




** Documentation **

   [RFC] [http://www.rfc-editor.org/info/rfc6151%|%Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms], 2011-03:   

   [RFC] [http://www.rfc-editor.org/info/rfc1321%|%1321], The MD5 Message-Digest Algorithm, 1992-04:   



** Description **

Anyone with some tips for the novice as to common uses for md5 and [sha1]? 

[DL]: Here are some common uses for md5:

   * When distributing software, an md5 hash is computed and advertised alongside the published software.  When the software is fetched, the user may recompute the md5 hash and compare it to the public md5 hash to have confidence that the downloaded distribution is indeed the one that was originally published.

   * The POP protocol can (as an option) avoid sending a plaintext password and instead send a hash of the password and the date.  This protects the plaintext password from capture while still ensuring a high-level of authentication.  You can see how this is coded in applications such as [tkbiff].

md5 is older and more commonly used than sha1 but sha1 is considered more secure.  However, for most purposes, md5 is good enough. 

[PT] - SHA and MD5 are both enhanced digests based upon the MD4 algorithm. Although MD4 has not been broken - attacks have been demonstrated against the first two rounds and separately against the final round. The publication of these cryptanalytic attacks lead to a strengthened algorithm - MD5. See the [sha1] page for details of how that has been strengthened. For MD5, the enhancements involve adding another round, adding a unique constant into each step, changing the round 2 function G to be less symmetrical. Each step now also includes the result of the previous step to speed up the avalanche effect. See [[[BOOK: Applied Cryptography] pp 436]].



** Misc **


[RS] 2006-10-20: Here's a little command line utility that returns the MD5 digest for one file, and, if specified, compares it with a second one:
======
#!/usr/bin/env tclsh
set usage {
    usage: md5.tcl filename ?filename2?
    prints the MD5 digest of the given file in hexadecimal to stdout.
    If filename2 is given, and its md5 digest differs from the first, 
    this is reported on stdout, and return code is 1. (If equal, 0).
}
if {[llength $argv] < 1} {puts stderr $usage; exit}

package require md5

set md1 [md5::md5 -hex -file [lindex $argv 0]]
puts $md1
if {[lindex $argv 1] ne {}} {
    set md2 [md5::md5 -hex -file [lindex $argv 1]]
    if {$md1 ne $md2} {puts "*** unequal: $md2"; exit 1}
}
======

----

[DcK] 2010-10-14: Here how to get an hexadecimal MD5 command on several platforms:

======
#Gets MD5 hash
proc md5 {string} {
    #tcllib way:
    package require md5
    string tolower [::md5::md5 -hex $string]

    #BSD way:
    #exec -- md5 -q -s $string

    #Linux way:
    #exec -- echo -n $string | md5sum | sed "s/\ *-/\ \ /"

    #Solaris way:
    #lindex [exec -- echo -n $string | md5sum] 0

    #OpenSSL way:
    #exec -- echo -n $string | openssl md5
}
======


----

[MJ] - See [https://fossil.mpcjanssen.nl/tcllib/vdiff?from=trunk&to=mjanssen-changes&sbs=0] for a version of md5 implemented using [tcc4tcl].


<<categories>> Cryptography | Package | tcllib