I read on Wikipedia, that at first MD6 had some problems with a buffer overflow, and a lack of proof of resilience against differential attacks; however, the article also says that that was fixed.

Yet, I struggle to find much else about MD6 and on the whole of SE there are only a couple of references, so what happened, and why does everyone talk about MD5 instead of the latest iteration MD6?

1 Answer 1


The short answer is that MD5 is widely discussed because it's had widespread historical use, and MD6 isn't because it's relatively unused and has faded into obscurity due to a multitude of better of alternatives.

Why isn't it more popular? It was an entrant in the SHA-3 competition, but was eliminated in the first round because it simply didn't stack up against the competition. It was noticeably slower than other competitors, didn't offer much in the way of advantages over them, and its formal proofs weren't complete.

In the meantime, SHA-2 is still considered secure and is in widespread use, the Keccak digest was chosen to become SHA-3 and serves as an emergency backup should Merkle–Damgård constructions in general become broken, and BLAKE2 — a derivative of one of the other finalists in the SHA-3 competition — has gained support as a direct successor to SHA-2 due to improved speed, security, and features. Given that, there's not much of a reason for anyone to further consider MD6.

  • 9
    @Melkor MD6 (and SHA-3 in general) is a general purpose cryptographic hash function, much like SHA-1, or SHA-256, not a password hashing function. For general purpose use, you definitely want fast. Password hashing is a special case and requires a different design. We didn't understand that when we used MD5 widely for password hashing, but we do now.
    – Xander
    Apr 19, 2017 at 22:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.