What does “bits” mean in the context of hash functions?

Question

What does the "bits" in hash functions mean?

I started studying hash functions but I still do not understand what the bits mean.

What does it mean to say that MD5 is 128-bits or that SHA-1 is 160 bits? How is this calculated?

Answer 1

That's referring to the size of the output, or message digest, of a hash function. MD5 outputs an 128-bit hash value. Or: there are $2^{128}$ possible outputs.

In Python:

>> md5("hello, world").hexdigest()
'e4d7f1b4ed2e42d15898f4b27b019da4'

You can see 32 hexadecimal (hex) digits that represent 16 bytes or 128 bits. Here's that value in binary; there are 128 $0$s and $1$s, or binary digits that represent bits:

  11100100110101111111000110110100111011010010111001000010110100010101100010011000111101001011001001111011000000011001110110100100

To calculate, just count them!

Likewise, for SHA-1, you have 160 bits, 20 bytes or 40 hex digits. There are $2^{160}$ possible outputs:

 >> sha1("hello, world").hexdigest()
 'b7e23ec29af22b0b4e41da31e868d57226121c84'

---

The output size of a hash is directly linked to the maximum security level that can be achieved. The security level is half of the bits if the birthday problem applies for example if the hash is over a string as above. It's the full amount if this isn't the case.

Note that both MD5 and SHA-1 are considered broken for most usage scenarios, so the above calculations do not apply to them anymore. The amount of security offered is much less than the output size would suggest.

Answer 2

One hexadecimal digit is of one nibble (4 bits). Two nibbles make 8 bits which are also called 1 byte.

MD5 generates an output (128 bit) which is represented using a sequence of 32 hexadecimal digits, which in turn are 32*4=128 bits. 128 bits make 16 bytes (since 1 byte is 8 bits).