I read somewhere MD5 is broken in terms of collision, but I am wondering if it is broken in terms of pre-image resistance?

Given a hash of Md5, is it possible to find the original message of it? If so, what would be the complexity and time to crack it?

  • 1
    $\begingroup$ Note that the pre-image resistance has little to do with password hashing. Brute force, dictionary attacks and rainbow tables are all possible against any hash if the input domain is small enough. Hence the reason for key strengthening functions such as PBKDF2, bcrypt and scrypt. $\endgroup$
    – Maarten Bodewes
    Nov 28, 2016 at 1:25
  • $\begingroup$ Also note that a pre-image attack is not about finding the original message, it is only about finding a message with the same hash as the original one. The first message you find that fits the hash is unlikely to be the original message unless the message domain is smaller that that of the hash. $\endgroup$
    – Dreamer
    Jul 12, 2017 at 8:36

1 Answer 1


The only published faster-than-brute-force preimage attack I can find is this one from 2009 by Yu Sasaki and Kazumaro Aoki.

From their abstract:

This attack, with a complexity of $2^{116.9}$, generates a pseudo-preimage of MD5 and, with a complexity of $2^{123.4}$, generates a preimage of MD5. The memory complexity of the attack is $2^{45}\times 11$ words.

In short, this is not practical at all.

  • 5
    $\begingroup$ any updates? where can I go to look for a reputable, up-to-date security status of hashes and their attacks? $\endgroup$
    – Jason S
    Dec 8, 2017 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.