0
$\begingroup$

As i read MD5 have many complex formulas, example:

$k_i := \lfloor \space| \sin(i + 1) \times 2^{32}| \space\rfloor$

My question is why use sin(), how about cos() or tan() or something like that. Does it make any sense when use sin() ? Or just for more complex of formula lead to more secure of algorithm ?

$\endgroup$

1 Answer 1

3
$\begingroup$

In MD5, the use of formulas with floating point arithmetic is limited to building 64 nothing-up-my-sleeves 32-bit constants. Most implementations use a precomputed table, for startup efficiency and portability.

Changing $\sin$ to $\cos$ would change the constants, but as far as we know would make the algorithm neither weaker nor stronger. That's the nature of nothing-up-my-sleeves constants.

There would be a problem with using $\tan$, because $\tan(11)\approx-225.95$, thus the input of floor would be 40-bit. We would need a floor variant with at-least 40-bit result, keep the low-order 32-bit part of the result, and ensure that $\tan$ is evaluated to at least 40-bit precision in the mantissa for portable values from an implementation to another¹.


MD5 has other arbitrary-looking formulas, operating on 32-bit unsigned integers assimilated to 32-bit vectors. These are optimized for their cryptographic properties, and changing them haphazardly stands high risk of weakening the algorithm (further than it is: its security goal of collision-resistance is not met).


¹ Incidentally: computing the MD5 constants using the built-in floating point arithmetic in the Arduino will fail to yield the correct table due to insufficient (non-conforming) precision of the double type there, and would cause the low-order 8 bits to be severely biased, with possible negative cryptographic consequences. The same effect causes many Arduino code using a GPS to be significantly less accurate than it should be. But I digress.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.