1

MD5 is a hash, so it is a one-way cryptographic function. But I am not sure that MD5 has only one hash per input?

Web application stores the passwords hashed with MD5, but when the user enters the password how can the application give access to that user? As the users password will be a hash with another string which is different from the older one.

And how do MD5 dictionaries work? We can get the reverse of the input, but how does it actually work?

9
  • 1
    It's not very clear what you're asking here: md5(1) will always give the same output. There is likely to be some other value which you can apply the md5 function to and get the same output hash, but that's OK - it's called a collision, and all general purpose hash functions have them, if you hash enough different values.
    – Matthew
    Oct 23, 2017 at 16:28
  • The web application hashes the entered password and compares the resulting hash with the stored hash in the database.
    – Arminius
    Oct 23, 2017 at 16:30
  • okay @Arminius then please tell me that "Is it possible to get one same hash value of the same input?" Oct 23, 2017 at 16:33
  • @januuagrawal Yes, the same input always produces the exact same hash value (for the same hash function, of course).
    – Arminius
    Oct 23, 2017 at 16:38
  • So, in the login form the Web application uses hash collision? @Arminius And please if so then answer my second confusion which i added above. Thank you Oct 23, 2017 at 16:40

1 Answer 1

5

MD5 is deterministic, meaning that if you hash the same input multiple times you will always get the same answer. So to see if a password provided by the client is correct, the server can just hash it again and see if the hash is the same as the stored hash.

Similarly, a MD5 dictionary works because someone has hashed common passwords and stored the results. If your hash is in the list, you can just look it up and see what input it corresponds to.

I think your central misunderstanding is that MD5 could give different results for the same input. It does not.

Also note that MD5 is not a safe algorithm to use for password storage. For how to do password hashing right, see this question.

1
  • Worth pointing out to the OP that MD5 is not a secure method for password storage. Oct 23, 2017 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.