Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that md5 shouldn't be used for password hashing because of collisions and possibility of making dictionary attacks e.g. using rainbow tables. But what about other uses? Can I use md5 for encrypting data?

Say, attacker gains access to database where sensitive data was stored using md5. He wants to know just this data that was hashed, not another data that gives this hash. Can he do it?

I know that there are better cryptographic hash functions so don't suggest to use them if md5 is enough.

share|improve this question
MD5 is not an encryption function, as there is no way to decrypt (even with a key). One can construct ciphers from hash functions (for example, see the answers to A simple block cipher based on the SHA-256 hash function and Is it feasible to build a stream cipher from a cryptographic hash function?, but I would not recommend using MD5 for this. – Paŭlo Ebermann Feb 2 '12 at 12:09
Collisions don't matter in password hashing. For password hashing you just need pre-image resistance. Plain sha1 is barely better for password hashing than plain md5. You need a salt and a method to slow down hashing, which leads to PBKDF2 or bcrypt. – CodesInChaos Feb 3 '12 at 10:14
up vote 4 down vote accepted

If the question is "if I just had MD5 as my sole cryptographical primitive, could I use it to encrypt", well, the answer is yes, you can. Then are a number of standard block cipher modes that don't assume invertability of the block cipher, and hence would work just find if you plopped MD5 (or rather, a keyed MD5, where you ask MD5 to hash both the input block and some keying data) right there. Examples of such modes are CFB, OFB and Counter mode. We don't do this in practice, both because MD5 hasn't been studied in such a mode (because the assumptions we're making on MD5 aren't the standard assumptions of hash functions, but ones concerning a large number of hashes from related images), so no one could say that it is secure), and because it would be rather slow.

On the other hand, your question would appear to be "if I have a database that includes an MD5 hash of some data, could I reconstruct what the original data was". Well, we don't normally call that "encryption" (because there's no way to undo that operation). And, if that is your question, the answer is no (unless you can guess what that data is, and verify it by doing an MD5 on your guess). Even if the original data was short enough that there is unlikely to be another string that short that hashes to the same value, there is no known way (other than brute force) to find MD5 preimages, much less a specific MD5 preimage.

share|improve this answer
On the second paragraph, there has been a recent attack on finding collision on the MD5 with just single block. Since the method used in finding collision and second-preimage for MD5 were very closely related, I don't see any reason why the recent attack can't be molded properly to find even single block second preimage. So, there is good chance that a work will come that that finds another string that short that hashes to same value and it can be found pretty easily! I am quiet sure about that and hence skeptic about using MD5. – Jalaj Feb 1 '12 at 23:10

Theoretically speaking, you should never use an insecure hash function even as a primitive in the construction of a secure encryption scheme, let alone use it for encryption. The reason for this is under all the theoretical definitions of semantic (or in public key model, equivalently the indistinguishable) security, the encryption scheme that you will construct is insecure.

The proof of the encryption scheme usually follows the following type of reduction. Assuming $\mathsf{X}$ is secure under the $\mathsf{Y}$ model, the encryption scheme is secure under the $\mathcal{A}$ attack. Here $\mathsf{X}$ is your assumptions, say the (collision, preimage, second-preimage, target collision, enhanced target collision) resistance property of the hash function family or computational assumptions like $\mathsf{DDH, DH}$ etc; $\mathsf{Y}$ can be standard model, random oracle model, ideal cipher model, uniform complexity model, non-uniform complexity model, etc; and $\mathcal{A}$ can be chosen plaintext, chosen ciphertext, known plaintext or known ciphertext attack.

Now in all the possible scenario, since you can find second preimage or collision for MD5 easily, $\mathsf{X}$ does not hold true. Hence, the implication is dangling. Recall that enhanced target collision resistance and target collision resistance are weaker notion of security than collision resistance and hence they will give you even less security guarantee.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.