Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

what should I do if my original message is greater than 64 bits? what is the process of padding in MD5?

As described in Internet Security: Cryptographic Principles, Algorithms and Protocols, page 138, the second step in MD5 is to append the length of the message:

enter image description here

Can someone help me understand exactly what happens when the message length is greater than $2^{64}$ bits?

share|improve this question
you mean greater than $2^{64}$ bits long, right? You realize that that is $2048$ petabytes, right? I'm hoping this isn't a problem you are actually facing. :) – mikeazo Apr 30 '13 at 15:48
@mikeazo: you never know when you may need the MD5 digest of exabytes of data! – Reid Apr 30 '13 at 16:53
Could you please cite your sources? (i.e. From where did you take this image?) – Paŭlo Ebermann Apr 30 '13 at 17:29
@PaŭloEbermann, I updated with the source. – mikeazo May 1 '13 at 1:14

I think the RFC, Section 3.2 has a little more clear description.

A 64-bit representation of b (the length of the message before the padding bits were added) is appended to the result of the previous step. In the unlikely event that b is greater than 2^64, then only the low-order 64 bits of b are used. (These bits are appended as two 32-bit words and appended low-order word first in accordance with the previous conventions.)

So, if the message length is b2 b1 b0 (where b2 is the most significant) where each b is 32 bits, then b0 b1 is appended as the message length. In otherwords, if the message is too large, just truncate the length (not the message) at 64 bits.

share|improve this answer

If the original message length $N$ is $2^{64}$ bits or longer, you encode the value $N \bmod 2^{64}$ in the final padding block, rather than just $N$. Alternatively, you can just always encode $N \bmod 2^{64}$; if $N < 2^{64}$, then they're the same value.

Now, this distinction between $N$ and $N \bmod 2^{64}$ doesn't happen at 64 bits, it's at $2^{64}= 18,446,744,073,709,551,626$ bits, or about 2000000 Terabytes. No one has ever hashed a message that long with MD5; even if we assume an MD5 compression function can be computed in 1nsec (massively overoptimistic), it'd take over a year to hash a message that large (and parallelism doesn't help).

share|improve this answer

As explained in other answers, the length is taken modulo $2^{64}$ for MD5, but messages longer than $2^{64}$ bits can be safely ignored for any practical purpose.

However, some hash functions use a different solution and forbid you to input a message longer than what can be stored in the counter. For instance the FIPS 180-4 standard defining SHA-1 states:

SHA-1 may be used to hash a message, $M$, having a length of $l$ bits, where $0≤l<2^{64}$.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.