4

Is there a way to actually find out whether a hash is MD5 or MD4?

For instance:

  • 10c7ccc7a4f0aff03c915c485565b9da is an MD5 hash
  • be08c2de91787c51e7aee5dd16ca4f76 is an MD4 hash

I know that there is a difference "security wise" but how can someone determine which hash is which "programming wise" or just by the eyes. Or is there really no way to know for sure?

Improve this question

2 Answers 2

Reset to default
11

... but how can someone determine which hash is which "programming wise" or just by the eyes. Or is there really no way to know for sure?

Both hash algorithms simply output bytes. There is no visible inherent structure in these bytes and no magic bytes or similar which could be used to detect the algorithm. In fact you would not be able to distinguish between MD4, MD5 or just 128 bit of random data just from looking at the output of the hash.

Improve this answer
2
  • 1
    It is not true to say that there is no inherent structure in the bytes. We just do not know of any methods to detect such a structure, and may never know. Their security often relies on the assumed difficulty of finding such any bias in the digests. Neither MD5 nor MD4 are information theoretic secure hashes.
    – forest
    Apr 3, 2016 at 6:11
  • 2
    @mrparanoiac: changed this to "no visible inherent structure" to accept the possibility of some kind of super complex inherent structure nobody detected so far. But this does not change the reasoning and conclusion.
    – Steffen Ullrich
    Apr 3, 2016 at 6:49
0

There is no way how to do that. For this reason. Both are functions, where the input space is infinite (ok, its finite, because of the finite Damgard Merkle padding, but lets consider it infite. It practically is.).

The result space of both functions is 2^128, because both produce 128 bit digests.

So we have an almost unlimited domain and a limited codomain. So there is (almost) unlimited number of collisions for each target for both functions.

Hence you can't distinguish which function was used, because you are not even able to tell, what was the source for one of these functions...

There may be one exception: if some of the hash functions does not generate some part of its codomain (but this would almost certainly also mean that the function is terribly broken). Then you would be able to say for sure that it can't be that function....

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.