Is it possible to find 128 bits $B$ such that $md5(B) = B$?

md5 has collisions that can be computed in acceptable time, but I did not find any papers on fixed points in md5.

As pointed out in this question from 2014, there is a 63.2% probability for a totally random hash function to have a fixed point. Since some time has passed, I would be interested in newer research into the topic of fixed points, even if the analysed algorithm is not md5 itself.


1 Answer 1


It is not known a practical method to find a 128-bit $B$ such that $\operatorname{MD5}(B)=B$. Argument: that's essentially a first-preimage attack against a variant of MD5 defined as $H(B)=\operatorname{MD5}(B)\oplus B$ restricted to $\{0,1\}^{128}$ input space, for the all-zero result; and MD5, as well as (conjecturally) that hash variant, is still strong as far as preimage attacks go.

Moreover, if we model MD5 as a random function (a natural model), the probability that there is a solution is $1-(1-2^{-128})^{(2^{128})}\ \approx\ 1-1/e\ \approx\ 63.2\%$. That leaves us far from sure that there exists a solution: odds are about 12/7.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.