1

MD5 is a hash, so it is a one-way cryptographic function. But I am not sure that MD5 has only one hash per input?

Web application stores the passwords hashed with MD5, but when the user enters the password how can the application give access to that user? As the users password will be a hash with another string which is different from the older one.

And how do MD5 dictionaries work? We can get the reverse of the input, but how does it actually work?

  • 1
    It's not very clear what you're asking here: md5(1) will always give the same output. There is likely to be some other value which you can apply the md5 function to and get the same output hash, but that's OK - it's called a collision, and all general purpose hash functions have them, if you hash enough different values. – Matthew Oct 23 '17 at 16:28
  • The web application hashes the entered password and compares the resulting hash with the stored hash in the database. – Arminius Oct 23 '17 at 16:30
  • okay @Arminius then please tell me that "Is it possible to get one same hash value of the same input?" – januu agrawal Oct 23 '17 at 16:33
  • @januuagrawal Yes, the same input always produces the exact same hash value (for the same hash function, of course). – Arminius Oct 23 '17 at 16:38
  • So, in the login form the Web application uses hash collision? @Arminius And please if so then answer my second confusion which i added above. Thank you – januu agrawal Oct 23 '17 at 16:40
5

MD5 is deterministic, meaning that if you hash the same input multiple times you will always get the same answer. So to see if a password provided by the client is correct, the server can just hash it again and see if the hash is the same as the stored hash.

Similarly, a MD5 dictionary works because someone has hashed common passwords and stored the results. If your hash is in the list, you can just look it up and see what input it corresponds to.

I think your central misunderstanding is that MD5 could give different results for the same input. It does not.

Also note that MD5 is not a safe algorithm to use for password storage. For how to do password hashing right, see this question.

  • Worth pointing out to the OP that MD5 is not a secure method for password storage. – Trickycm Oct 23 '17 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.