Can md5 be used for encrypting data?

Question

I know that md5 shouldn't be used for password hashing because of collisions and possibility of making dictionary attacks e.g. using rainbow tables. But what about other uses? Can I use md5 for encrypting data?

Say, attacker gains access to database where sensitive data was stored using md5. He wants to know just this data that was hashed, not another data that gives this hash. Can he do it?

I know that there are better cryptographic hash functions so don't suggest to use them if md5 is enough.

Answer 1

If the question is "if I just had MD5 as my sole cryptographical primitive, could I use it to encrypt", well, the answer is yes, you can. Then are a number of standard block cipher modes that don't assume invertability of the block cipher, and hence would work just find if you plopped MD5 (or rather, a keyed MD5, where you ask MD5 to hash both the input block and some keying data) right there. Examples of such modes are CFB, OFB and Counter mode. We don't do this in practice, both because MD5 hasn't been studied in such a mode (because the assumptions we're making on MD5 aren't the standard assumptions of hash functions, but ones concerning a large number of hashes from related images), so no one could say that it is secure), and because it would be rather slow.

On the other hand, your question would appear to be "if I have a database that includes an MD5 hash of some data, could I reconstruct what the original data was". Well, we don't normally call that "encryption" (because there's no way to undo that operation). And, if that is your question, the answer is no (unless you can guess what that data is, and verify it by doing an MD5 on your guess). Even if the original data was short enough that there is unlikely to be another string that short that hashes to the same value, there is no known way (other than brute force) to find MD5 preimages, much less a specific MD5 preimage.

Answer 2

Theoretically speaking, you should never use an insecure hash function even as a primitive in the construction of a secure encryption scheme, let alone use it for encryption. The reason for this is under all the theoretical definitions of semantic (or in public key model, equivalently the indistinguishable) security, the encryption scheme that you will construct is insecure.

The proof of the encryption scheme usually follows the following type of reduction. Assuming $\mathsf{X}$ is secure under the $\mathsf{Y}$ model, the encryption scheme is secure under the $\mathcal{A}$ attack. Here $\mathsf{X}$ is your assumptions, say the (collision, preimage, second-preimage, target collision, enhanced target collision) resistance property of the hash function family or computational assumptions like $\mathsf{DDH, DH}$ etc; $\mathsf{Y}$ can be standard model, random oracle model, ideal cipher model, uniform complexity model, non-uniform complexity model, etc; and $\mathcal{A}$ can be chosen plaintext, chosen ciphertext, known plaintext or known ciphertext attack.

Now in all the possible scenario, since you can find second preimage or collision for MD5 easily, $\mathsf{X}$ does not hold true. Hence, the implication is dangling. Recall that enhanced target collision resistance and target collision resistance are weaker notion of security than collision resistance and hence they will give you even less security guarantee.