md5c加密解密算法

Ⅰ MD5解密的原理是什么

介绍MD5加密算法基本情况MD5的全称是Message-Digest
Algorithm
5，在90年代初由MIT的计算机科学实验室和RSA
Data
Security
Inc发明，经MD2、MD3和MD4发展而来。
Message-Digest泛指字节串(Message)的Hash变换，就是把一个任意长度的字节串变换成一定长的大整数。请注意我使用了"字节串"而不是"字符串"这个词，是因为这种变换只与字节的值有关，与字符集或编码方式无关。
MD5将任意长度的"字节串"变换成一个128bit的大整数，并且它是一个不可逆的字符串变换算法，换句话说就是，即使你看到源程序和算法描述，也无法将一个MD5的值变换回原始的字符串，从数学原理上说，是因为原始的字符串有无穷多个，这有点象不存在反函数的数学函数。
MD5的典型应用是对一段Message(字节串)产生fingerprint(指纹)，以防止被"篡改"。举个例子，你将一段话写在一个叫readme.txt文件中，并对这个readme.txt产生一个MD5的值并记录在案，然后你可以传播这个文件给别人，别人如果修改了文件中的任何内容，你对这个文件重新计算MD5时就会发现。如果再有一个第三方的认证机构，用MD5还可以防止文件作者的"抵赖"，这就是所谓的数字签名应用。
MD5还广泛用于加密和解密技术上，在很多操作系统中，用户的密码是以MD5值（或类似的其它算法）的方式保存的，用户Login的时候，系统是把用户输入的密码计算成MD5值，然后再去和系统中保存的MD5值进行比较，而系统并不"知道"用户的密码是什么。
一些黑客破获这种密码的方法是一种被称为"跑字典"的方法。有两种方法得到字典，一种是日常搜集的用做密码的字符串表，另一种是用排列组合方法生成的，先用MD5程序计算出这些字典项的MD5值，然后再用目标的MD5值在这个字典中检索。
即使假设密码的最大长度为8，同时密码只能是字母和数字，共26+26+10=62个字符，排列组合出的字典的项数则是P(62,1)+P(62,2)....+P(62,8)，那也已经是一个很天文的数字了，存储这个字典就需要TB级的磁盘组，而且这种方法还有一个前提，就是能获得目标账户的密码MD5值的情况下才可以。
在很多电子商务和社区应用中，管理用户的Account是一种最常用的基本功能，尽管很多Application
Server提供了这些基本组件，但很多应用开发者为了管理的更大的灵活性还是喜欢采用关系数据库来管理用户，懒惰的做法是用户的密码往往使用明文或简单的变换后直接保存在数据库中，因此这些用户的密码对软件开发者或系统管理员来说可以说毫无保密可言，本文的目的是介绍MD5的Java
Bean的实现，同时给出用MD5来处理用户的Account密码的例子，这种方法使得管理员和程序设计者都无法看到用户的密码，尽管他们可以初始化它们。但重要的一点是对于用户密码设置习惯的保护

Ⅱ CMD5解密

妈的一帮菜鸟不懂装懂！算不出来就不要出声！这个就是算出来的结果！
958118xy
本来不想回答的，才10分，但是见到一些“高手”，不答不行了。
最好加点分吧

Ⅲ MD5怎么解密

MD5的全称是Message-digest Algorithm 5（信息-摘要算法），用于确保信息传输完整一致。在90年代初由MIT Laboratory for Computer Science和RSA Data Security Inc,的Ronald L. Rivest开发出来，经MD2、MD3和MD4发展而来。它的作用是让大容量信息在用数字签名软件签署私人密钥前被"压缩"成一种保密的格式（就是把一个任意长度的字节串变换成一定长的大整数）。不管是MD2、MD4还是MD5，它们都需要获得一个随机长度的信息并产生一个128位的信息摘要。虽然这些算法的结构或多或少有些相似，但MD2的设计与MD4和MD5完全不同，那是因为MD2是为8位机器做过设计优化的，而MD4和MD5却是面向32位的电脑。这三个算法的描述和c语言源代码在Internet RFC 1321中有详细的描述（），这是一份最权威的文档，由Ronald L. Rivest在1992年8月向IETF提交。 MD5的典型应用是对一段信息（Message）产生信息摘要（Message-Digest），以防止被篡改。 所以现在会把一些软件用MD5加密后，你下载下再用MD5工具查看，如果与提供的MD5编码相同就是原来的，如果不同就是此文件已被修改过~~ ~

还有不明的，请问，

Ⅳ 关于哈希加密MD5算法

四种加密解密算法的源代码：移位密码、仿射密码、维吉尼亚密码以及置换密码

#include <stdio.h>
#include <conio.h>
#include <string.h>
#include <malloc.h>
void Shift() /*移位密码*/
{
char c[100];
int length, i=0, key=0;
clrscr();

printf("********Shift Cipher********\nPlease input primal sentence: ");
gets(c);
length = strlen(c);
printf("Input the key(0~26): ");
scanf("%d", &key);
getchar();

if(key<0)
{
printf("The value of key is error!\nPress any key to return...");
getch();
return;
}
for(i=0; i<length; i++)
{
if(c[i]>96&&c[i]<123)
c[i] = (c[i]+key-97)%26+65;
else if(c[i]>64&&c[i]<91)
c[i] = (c[i]+key-65)%26+65;
}
printf("Result is: %s\n", c);
for(i=0; i<length; i++)
{
if(c[i]>64&&c[i]<91)
c[i] = (c[i]-key-65+26)%26+97;
}
printf("\nAfter translated the sentence,we can see the primal sentence as follow:\n%s\n", c);
printf("Press any key to return...");
getch();
}

int gcd(int a, int b) /*辗转相除法求a,b的最大公因数*/
{
int k = 0;

do
{
k = a%b;
a = b;
b = k;
}while(k!=0);
return a;
}

int Ni(int a, int b) /*求a相对于b的逆*/
{
int i = 0;
while(a*(++i)%b!=1);
return i;
}

void Affine() /*仿射密码*/
{
char c[100];
int length, i=0, ka=0, kb=0, tmp;
clrscr();

printf("********Affine Cipher********\nPlease input primal sentence: ");
gets(c);
length = strlen(c);
printf("Input the key(2 numbers): ");
scanf("%d%d", &ka, &kb);
getchar();
if(gcd(ka,26)!=1)
{
printf("The value of the key is error!\nPress any key to return...");
return;
}

for(i=0; i<length; i++)
{
if(c[i]>96&&c[i]<123)
c[i] = (ka*(c[i]-97)+kb)%26+65;
else if(c[i]>64&&c[i]<91)
c[i] = (ka*(c[i]-65)+kb)%26+65;
}
printf("Result is: %s\n", c);
for(i=0; i<length; i++)
{
if(c[i]>64&&c[i]<91)
{
tmp = Ni(ka,26)*((c[i]-65)-kb);
if(tmp<0)
c[i] = tmp%26+26+97;
else
c[i] = tmp%26+97;
}
}
printf("\nAfter translated the sentence,we can see the primal sentence as follow:\n%s\n", c);
printf("Press any key to return...");
getch();
}

void Vigenere() /*维吉利亚密码*/
{
char c[100], key[100];
int lenc, lenk, i=0, j=0, tmp;
clrscr();

printf("********Vigenere Cipher********\nPlease input primal sentence: ");
gets(c);
lenc = strlen(c);
strcpy(c, strupr(c));
printf("Input the key: ");
gets(key);
lenk = strlen(key);
strcpy(key, strupr(key));
for(; i<lenc; i++)
{
j = j%lenk;
if(c[i]>64&&c[i]<91)
{
c[i] = (c[i]-65+key[j]-65)%26+65;
j++;
}
}
printf("Result is: %s\n", c);
for(i=0, j=0; i<lenc; i++)
{
j = j%lenk;
if(c[i]>64&&c[i]<91)
{
tmp = c[i]-65-(key[j]-65);
if(tmp>=0)
c[i] = tmp%26+97;
else
c[i] = (tmp+26)%26+97;
j++;
}
}
printf("\nAfter translated the sentence,we can see the primal sentence as follow:\n%s\n", c);
printf("Press any key to return...");
getch();
}

void Permutation() /*置换密码*/
{
char c[100], *q;
int *key, len, m, i, j=0;
clrscr();

printf("********Permutation Cipher********\nPlease input primal sentence: ");
gets(c);
strcpy(c, strupr(c));
len = strlen(c);
for(i=0; i<len; i++)
{
if(c[i]<65||c[i]>90)
{
for(j=i; j<len-1; j++)
c[j] = c[j+1];
len--;
}
}
c[len] = '\0';
printf("Input the length of the key: ");
scanf("%d", &m);
key = (int)malloc(m*sizeof(int));
q = (int)malloc(len*sizeof(int));
printf("Input the key: ");
for(i=0; i<m; i++)
{
scanf("%d", key+i);
key[i]--;
}
getchar();

for(i=0; i<len; i++)
{
j = (i/m)*m;
q[i] = c[*(key+i%m)+j];
}
q[i] = '\0';

printf("Result is: %s\n", q);

for(i=0, j=0; i<len; i++)
{
j = (i/m)*m;
c[*(key+i%m)+j] = q[i]+32;
}
c[len] = '\0';

printf("After translated the sentence,we can see the primal sentence as follow:\n%s\n", c);
printf("Press any key to return...");
free(key);
free(q);
getch();
}

void main()
{
char i = '0';
clrscr();

while(i!='5')
{
clrscr();
printf("********Press 1~5 to choose:********\n");
printf("1. Shift Cipher\n2. Affine Cipher\n3. Vigenere Cipher\n4. Permutation Cipher\n5. Exit\n");
i = getch();
if(i=='1')
Shift();
else if(i=='2')
Affine();
else if(i=='3')
Vigenere();
else if(i=='4')
Permutation();
else if(i=='5')
break;
}
}

Ⅳ 急求 MD5的加密解密算法，用C++实现的源代码 高分答谢

要代码，还是要相关的解释资料？

---------------------------------
要代码的话：

两个文件：
--------------------------
1. md5.h：

#pragma once

typedef unsigned long int UINT32;
typedef unsigned short int UINT16;

/* MD5 context. */
typedef struct {
UINT32 state[4]; /* state (ABCD) */
UINT32 count[2]; /* number of bits, molo 2^64 (lsb first) */
unsigned char buffer[64]; /* input buffer */
} MD5_CTX;

void MD5Init (MD5_CTX *);
void MD5Update (MD5_CTX *, unsigned char *, unsigned int);
void MD5Final (unsigned char [16], MD5_CTX *);

--------------------------
2. md5.cpp：

#include "md5.h"

#include "memory.h"

#define S11 7
#define S12 12
#define S13 17
#define S14 22
#define S21 5
#define S22 9
#define S23 14
#define S24 20
#define S31 4
#define S32 11
#define S33 16
#define S34 23
#define S41 6
#define S42 10
#define S43 15
#define S44 21

static void MD5Transform (UINT32 a[4], unsigned char b[64]);
static void Encode (unsigned char *, UINT32 *, unsigned int);
static void Decode (UINT32 *, unsigned char *, unsigned int);

static unsigned char PADDING[64] = {
0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
};

#define F(x, y, z) (((x) & (y)) | ((~x) & (z)))
#define G(x, y, z) (((x) & (z)) | ((y) & (~z)))
#define H(x, y, z) ((x) ^ (y) ^ (z))
#define I(x, y, z) ((y) ^ ((x) | (~z)))

#define ROTATE_LEFT(x, n) (((x) << (n)) | ((x) >> (32-(n))))

#define FF(a, b, c, d, x, s, ac) { \
(a) += F ((b), (c), (d)) + (x) + (UINT32)(ac); \
(a) = ROTATE_LEFT ((a), (s)); \
(a) += (b); \
}
#define GG(a, b, c, d, x, s, ac) { \
(a) += G ((b), (c), (d)) + (x) + (UINT32)(ac); \
(a) = ROTATE_LEFT ((a), (s)); \
(a) += (b); \
}
#define HH(a, b, c, d, x, s, ac) { \
(a) += H ((b), (c), (d)) + (x) + (UINT32)(ac); \
(a) = ROTATE_LEFT ((a), (s)); \
(a) += (b); \
}
#define II(a, b, c, d, x, s, ac) { \
(a) += I ((b), (c), (d)) + (x) + (UINT32)(ac); \
(a) = ROTATE_LEFT ((a), (s)); \
(a) += (b); \
}

void MD5Init (MD5_CTX *context)
{
context->count[0] = context->count[1] = 0;

context->state[0] = 0x67452301;
context->state[1] = 0xefcdab89;
context->state[2] = 0x98badcfe;
context->state[3] = 0x10325476;
}

void MD5Update (MD5_CTX *context, unsigned char *input, unsigned int inputLen)
{
unsigned int i, index, partLen;

index = (unsigned int)((context->count[0] >> 3) & 0x3F);

if ((context->count[0] += ((UINT32)inputLen << 3))
< ((UINT32)inputLen << 3))
context->count[1]++;
context->count[1] += ((UINT32)inputLen >> 29);

partLen = 64 - index;

if (inputLen >= partLen) {
memcpy((unsigned char *)&context->buffer[index], (unsigned char *)input, partLen);
MD5Transform (context->state, context->buffer);

for (i = partLen; i + 63 < inputLen; i += 64)
MD5Transform (context->state, &input[i]);

index = 0;
}
else
i = 0;

memcpy((unsigned char *)&context->buffer[index], (unsigned char *)&input[i],
inputLen-i);
}

void MD5Final (unsigned char digest[16], MD5_CTX * context)
{
unsigned char bits[8];
unsigned int index, padLen;

Encode (bits, context->count, 8);

index = (unsigned int)((context->count[0] >> 3) & 0x3f);
padLen = (index < 56) ? (56 - index) : (120 - index);
MD5Update (context, PADDING, padLen);

MD5Update (context, bits, 8);

Encode (digest, context->state, 16);

memset ((unsigned char *)context, 0, sizeof (*context));
}

static void MD5Transform (UINT32 state[4], unsigned char block[64])
{
UINT32 a = state[0], b = state[1], c = state[2], d = state[3], x[16];

Decode (x, block, 64);

/* Round 1 */
FF (a, b, c, d, x[ 0], S11, 0xd76aa478); /* 1 */
FF (d, a, b, c, x[ 1], S12, 0xe8c7b756); /* 2 */
FF (c, d, a, b, x[ 2], S13, 0x242070db); /* 3 */
FF (b, c, d, a, x[ 3], S14, 0xc1bdceee); /* 4 */
FF (a, b, c, d, x[ 4], S11, 0xf57c0faf); /* 5 */
FF (d, a, b, c, x[ 5], S12, 0x4787c62a); /* 6 */
FF (c, d, a, b, x[ 6], S13, 0xa8304613); /* 7 */
FF (b, c, d, a, x[ 7], S14, 0xfd469501); /* 8 */
FF (a, b, c, d, x[ 8], S11, 0x698098d8); /* 9 */
FF (d, a, b, c, x[ 9], S12, 0x8b44f7af); /* 10 */
FF (c, d, a, b, x[10], S13, 0xffff5bb1); /* 11 */
FF (b, c, d, a, x[11], S14, 0x895cd7be); /* 12 */
FF (a, b, c, d, x[12], S11, 0x6b901122); /* 13 */
FF (d, a, b, c, x[13], S12, 0xfd987193); /* 14 */
FF (c, d, a, b, x[14], S13, 0xa679438e); /* 15 */
FF (b, c, d, a, x[15], S14, 0x49b40821); /* 16 */

/* Round 2 */
GG (a, b, c, d, x[ 1], S21, 0xf61e2562); /* 17 */
GG (d, a, b, c, x[ 6], S22, 0xc040b340); /* 18 */
GG (c, d, a, b, x[11], S23, 0x265e5a51); /* 19 */
GG (b, c, d, a, x[ 0], S24, 0xe9b6c7aa); /* 20 */
GG (a, b, c, d, x[ 5], S21, 0xd62f105d); /* 21 */
GG (d, a, b, c, x[10], S22, 0x2441453); /* 22 */
GG (c, d, a, b, x[15], S23, 0xd8a1e681); /* 23 */
GG (b, c, d, a, x[ 4], S24, 0xe7d3fbc8); /* 24 */
GG (a, b, c, d, x[ 9], S21, 0x21e1cde6); /* 25 */
GG (d, a, b, c, x[14], S22, 0xc33707d6); /* 26 */
GG (c, d, a, b, x[ 3], S23, 0xf4d50d87); /* 27 */
GG (b, c, d, a, x[ 8], S24, 0x455a14ed); /* 28 */
GG (a, b, c, d, x[13], S21, 0xa9e3e905); /* 29 */
GG (d, a, b, c, x[ 2], S22, 0xfcefa3f8); /* 30 */
GG (c, d, a, b, x[ 7], S23, 0x676f02d9); /* 31 */
GG (b, c, d, a, x[12], S24, 0x8d2a4c8a); /* 32 */

/* Round 3 */
HH (a, b, c, d, x[ 5], S31, 0xfffa3942); /* 33 */
HH (d, a, b, c, x[ 8], S32, 0x8771f681); /* 34 */
HH (c, d, a, b, x[11], S33, 0x6d9d6122); /* 35 */
HH (b, c, d, a, x[14], S34, 0xfde5380c); /* 36 */
HH (a, b, c, d, x[ 1], S31, 0xa4beea44); /* 37 */
HH (d, a, b, c, x[ 4], S32, 0x4bdecfa9); /* 38 */
HH (c, d, a, b, x[ 7], S33, 0xf6bb4b60); /* 39 */
HH (b, c, d, a, x[10], S34, 0xbebfbc70); /* 40 */
HH (a, b, c, d, x[13], S31, 0x289b7ec6); /* 41 */
HH (d, a, b, c, x[ 0], S32, 0xeaa127fa); /* 42 */
HH (c, d, a, b, x[ 3], S33, 0xd4ef3085); /* 43 */
HH (b, c, d, a, x[ 6], S34, 0x4881d05); /* 44 */
HH (a, b, c, d, x[ 9], S31, 0xd9d4d039); /* 45 */
HH (d, a, b, c, x[12], S32, 0xe6db99e5); /* 46 */
HH (c, d, a, b, x[15], S33, 0x1fa27cf8); /* 47 */
HH (b, c, d, a, x[ 2], S34, 0xc4ac5665); /* 48 */

/* Round 4 */
II (a, b, c, d, x[ 0], S41, 0xf4292244); /* 49 */
II (d, a, b, c, x[ 7], S42, 0x432aff97); /* 50 */
II (c, d, a, b, x[14], S43, 0xab9423a7); /* 51 */
II (b, c, d, a, x[ 5], S44, 0xfc93a039); /* 52 */
II (a, b, c, d, x[12], S41, 0x655b59c3); /* 53 */
II (d, a, b, c, x[ 3], S42, 0x8f0ccc92); /* 54 */
II (c, d, a, b, x[10], S43, 0xffeff47d); /* 55 */
II (b, c, d, a, x[ 1], S44, 0x85845dd1); /* 56 */
II (a, b, c, d, x[ 8], S41, 0x6fa87e4f); /* 57 */
II (d, a, b, c, x[15], S42, 0xfe2ce6e0); /* 58 */
II (c, d, a, b, x[ 6], S43, 0xa3014314); /* 59 */
II (b, c, d, a, x[13], S44, 0x4e0811a1); /* 60 */
II (a, b, c, d, x[ 4], S41, 0xf7537e82); /* 61 */
II (d, a, b, c, x[11], S42, 0xbd3af235); /* 62 */
II (c, d, a, b, x[ 2], S43, 0x2ad7d2bb); /* 63 */
II (b, c, d, a, x[ 9], S44, 0xeb86d391); /* 64 */

state[0] += a;
state[1] += b;
state[2] += c;
state[3] += d;

memset ((unsigned char *)x, 0, sizeof (x));
}

static void Encode (unsigned char *output, UINT32 *input, unsigned int len)
{
unsigned int i, j;

for (i = 0, j = 0; j < len; i++, j += 4) {
output[j] = (unsigned char)(input[i] & 0xff);
output[j+1] = (unsigned char)((input[i] >> 8) & 0xff);
output[j+2] = (unsigned char)((input[i] >> 16) & 0xff);
output[j+3] = (unsigned char)((input[i] >> 24) & 0xff);
}
}

static void Decode (UINT32 *output, unsigned char *input, unsigned int len)
{
unsigned int i, j;

for (i = 0, j = 0; j < len; i++, j += 4)
output[i] = ((UINT32)input[j]) | (((UINT32)input[j+1]) << 8) |
(((UINT32)input[j+2]) << 16) | (((UINT32)input[j+3]) << 24);
}

--------------------------
就这两个文件。使用的时候把它们加入工程或者makefile，调用时包含md5.h即可，给个简单的例子，输入一个字符串然后计算它的md5值并输出，在VC6.0和GCC4.4下测试通过：

#include <stdio.h>
#include <string.h>

#include "md5.h"

int main ()
{
char tmp[128];
unsigned char digest[16];

MD5_CTX context;

scanf("%s",tmp);

MD5Init (&context);
MD5Update (&context, (unsigned char*)tmp, strlen(tmp));
MD5Final (digest,&context);

printf("MD5Value:");
for(int i=0; i<16; ++i)
{
printf("%02X",digest[i]);
}
printf("\n");

return 0;
}

Ⅵ MD5如何解密

MD5的全称是Message-digest Algorithm 5（信息-摘要算法），用于确保信息传输完整一致。在90年代初由MIT Laboratory for Computer Science和RSA Data Security Inc,的Ronald L. Rivest开发出来，经MD2、MD3和MD4发展而来。它的作用是让大容量信息在用数字签名软件签署私人密钥前被"压缩"成一种保密的格式（就是把一个任意长度的字节串变换成一定长的大整数）。不管是MD2、MD4还是MD5，它们都需要获得一个随机长度的信息并产生一个128位的信息摘要。虽然这些算法的结构或多或少有些相似，但MD2的设计与MD4和MD5完全不同，那是因为MD2是为8位机器做过设计优化的，而MD4和MD5却是面向32位的电脑。这三个算法的描述和c语言源代码在Internet RFC 1321中有详细的描述（），这是一份最权威的文档，由Ronald L. Rivest在1992年8月向IETF提交。 MD5的典型应用是对一段信息（Message）产生信息摘要（Message-Digest），以防止被篡改。 所以现在会把一些软件用MD5加密后，你下载下再用MD5工具查看，如果与提供的MD5编码相同就是原来的，如果不同就是此文件已被修改过~~ ~

Ⅶ ACCESS 中MD5加密后怎么解密

MD5是一种不可逆的加密算法，
什么是不可逆呢？就是加了密后，就不能解了。
现在网上的诸多所谓的“MD5解密工具”其实都是暴力破解，什么叫暴力破解呢？
那就是这些软件都有一些“字典文件”，其实就是一些常用的字符串及其加密过后的md5密文，例：软件首先把a加密成md5密文，然后用密文和现在要破解的密文进行比较，如果相同，那当然就破解了是a,如果不同，那么依此继续将b,c... 作同样的处理，也就是说，这些破解工具完全是用猜的，a不行猜b,b不行猜c,用循环一直往下猜。所以你想要找一个md5解密的软件，我劝楼主还是省了这份心吧，因为这些软件破解成功的机率很小。。
那么明白了md5后，即然它只能加密，不能解密，我们通常用它做什么呢？我们主要用它加密一些敏感数据，如用户的密码，把密码加密成md5后存入数据库。这样即使用户得到了数据库，也不知道用户的密码是什么。
那么我们是怎么来使用这个密文的呢？也就是用户在登录的时候，是怎么判断用户输入的密码是不是和数据库中的密码(md5加密后的)一致的呢？我们是在用户登录的时候，把用户输入的密码再加密成md5,然后用这个加密后的md5密文和数据库中存的用户的md5密文来进行比较，如果两个密文一样，说明用户输对了密码，否则就说明用户输入的是错误的密码。

现在你知道了md5了吧？
如果md5和一般的加密算法一样，能加密就能轻松解密，那还有加密的意义吗？反正加了别人也可以解，不是白加？所以md5是相对来说很安全的一种加密算法，当然也不能说它是绝对的安全，因为毕竟还有暴力破解，如果你的密码很简单，别人说不定用暴力破解就把你的密码给解出来了咯。呵呵～～
有关更多的网页知识，请点击：

Ⅷ 谁可以告诉我md5加密原理

2004年，已经被山东大学的王小云教授破解了。

以下是她在国际密码学会上发表的破解原理论文。
Collisions for Hash Functions
Collisions for Hash Functions
MD4, MD5, HAVAL-128 and RIPEMD
Xiaoyun Wang1, Dengguo Feng2, Xuejia Lai3, Hongbo Yu1
The School of Mathematics and System Science, Shandong University, Jinan250100, China1
Institute of Software, Chinese Academy of Sciences, Beijing100080, China2
Dept. of Computer Science and Engineering, Shanghai Jiaotong University, Shanghai, China3
[email protected]
revised on August 17, 2004

1 Collisions for MD5
MD5 is the hash function designed by Ron Rivest [9] as a strengthened version of MD4 [8]. In 1993 Bert den
Boer and Antoon Bosselaers [1] found pseudo-collision for MD5 which is made of the same message with two
different sets of initial value. H. Dobbertin[3] found a free-start collision which consists of two different 512-bit
messages with a chosen initial value 0 V I .
ED BA x C B F x C B AC x A V I 763 4 0 D , 97 62 5 0 , 341042 3 0x B , 2375 12 0 : 0 0 0 0 0
Our attack can find many real collisions which are composed of two 1024-bit messages with the original
initial value 0 IV of MD5:
10325476 0 , 98 0 , 89 0 67452301 0 : 0 0 0 0 0 x D badcfe x C xefcdab ,B x A IV
) 0 , 2 ,..., 2 ,..., 2 , 0 , 0 , 0 , 0 ( , 31 15 31
1 1 C C M M
) 0 , 2 ,..., 2 ,..., 2 , 0 , 0 , 0 , 0 ( , 31 15 31
2 2 C C N N i i
(non-zeros at position 4,11 and 14)
such that
) , ( 5 ) , ( 5 i i N M MD N M MD .
On IBM P690, it takes about one hour to find such M and M , after that, it takes only 15 seconds to 5
minutes to find i N and i N , so that ) , ( i N M and ) , ( i N M will proce the same hash same value. Moreover,
our attack works for any given initial value.
The following are two pairs of 1024-bit messages procing collisions, the two examples have the same 1-st
half 512 bits.
M
2dd31d1 c4eee6c5 69a3d69 5cf9af98 87b5ca2f ab7e4612 3e580440 897ffbb8
634ad55 2b3f409 8388e483 5a417125 e8255108 9fc9cdf7 f2bd1dd9 5b3c3780
X1
N1
d11d0b96 9c7b41dc f497d8e4 d555655a c79a7335 cfdebf0 66f12930 8fb109d1
797f2775 eb5cd530 baade822 5c15cc79 ddcb74ed 6dd3c55f d80a9bb1 e3a7cc35
M0
2dd31d1 c4eee6c5 69a3d69 5cf9af98 7b5ca2f ab7e4612 3e580440 897ffbb8
634ad55 2b3f409 8388e483 5a41f125 e8255108 9fc9cdf7 72bd1dd9 5b3c3780
X1
N1
d11d0b96 9c7b41dc f497d8e4 d555655a 479a7335 cfdebf0 66f12930 8fb109d1
797f2775 eb5cd530 baade822 5c154c79 ddcb74ed 6dd3c55f 580a9bb1 e3a7cc35
H 9603161f f41fc7ef 9f65ffbc a30f9dbf
M
2dd31d1 c4eee6c5 69a3d69 5cf9af98 87b5ca2f ab7e4612 3e580440 897ffbb8
634ad55 2b3f409 8388e483 5a417125 e8255108 9fc9cdf7 f2bd1dd9 5b3c3780
X2
N2
313e82d8 5b8f3456 d4ac6dae c619c936 b4e253dd fd03da87 6633902 a0cd48d2
42339fe9 e87e570f 70b654ce 1e0da880 bc2198c6 9383a8b6 2b65f996 702af76f
M0
2dd31d1 c4eee6c5 69a3d69 5cf9af98 7b5ca2f ab7e4612 3e580440 897ffbb8
634ad55 2b3f409 8388e483 5a41f125 e8255108 9fc9cdf7 72bd1dd9 5b3c3780

313e82d8 5b8f3456 d4ac6dae c619c936 34e253dd fd03da87 6633902 a0cd48d2
42339fe9 e87e570f 70b654ce 1e0d2880 bc2198c6 9383a8b6 ab65f996 702af76f
H 8d5e7019 6324c015 715d6b58 61804e08
Table 1 Two pairs of collisions for MD5
2 Collisions for HAVAL-128
HAVAL is proposed in [10]. HAVAL is a hashing algorithm that can compress messages of any length in 3,4
or 5 passes and proce a fingerprint of length 128, 160, 192 or 224 bits.
Attack on a reced version for HAVAL was given by P. R. Kasselman and W T Penzhorn [7], which
consists of last rounds for HAVAL-128. We break the full HAVAL-128 with only about the 26 HAVAL
computations. Here we give two examples of collisions of HAVAL-128, where
) 0 ,..., 0 , 2 ,.... 2 , 0 , 0 , 0 , 2 ( , 8 12 1 i i i C C M M
with non-zeros at position 0,11,18, and 31 ,... 2 , 1 , 0 i , such that ) ( ) ( M HAVAL M HAVAL .
M1
6377448b d9e59f18 f2aa3cbb d6cb92ba ee544a44 879fa576 1ca34633 76ca5d4f
a67a8a42 8d3adc8b b6e3d814 5630998d 86ea5dcd a739ae7b 54fd8e32 acbb2b36
38183c9a b67a9289 c47299b2 27039ee5 dd555e14 839018d8 aabbd9c9 d78fc632
fff4b3a7 40000096 7f466aac fffffbc0 5f4016d2 5f4016d0 12e2b0 f4307f87
M1
6377488b d9e59f18 f2aa3cbb d6cb92ba ee544a44 879fa576 1ca34633 76ca5d4f
a67a8a42 8d3adc8b b6e3d814 d630998d 86ea5dcd a739ae7b 54fd8e32 acbb2b36
38183c9a b67a9289 c47299ba 27039ee5 dd555e14 839018d8 aabbd9c9 d78fc632
fff4b3a7 40000096 7f466aac fffffbc0 5f4016d2 5f4016d0 12e2b0 f4307f87
H 95b5621c ca62817a a48dacd8 6d2b54bf
M2
6377448b d9e59f18 f2aa3cbb d6cb92ba ee544a44 879fa576 1ca34633 76ca5d4f
a67a8a42 8d3adc8b b6e3d814 5630998d 86ea5dcd a739ae7b 54fd8e32 acbb2b36
38183c9a b67a9289 c47299b2 27039ee5 dd555e14 839018d8 aabbd9c9 d78fc632
fff4b3a7 40000096 7f466aac fffffbc0 5f4016d2 5f4016d0 12e2b0 f5b16963

6377488b d9e59f18 f2aa3cbb d6cb92ba ee544a44 879fa576 1ca34633 76ca5d4f
a67a8a42 8d3adc8b b6e3d814 d630998d 86ea5dcd a739ae7b 54fd8e32 acbb2b36
38183c9a b67a9289 c47299ba 27039ee5 dd555e14 839018d8 aabbd9c9 d78fc632
fff4b3a7 40000096 7f466aac fffffbc0 5f4016d2 5f4016d0 12e2b0 f5b16963
H b0e99492 d64eb647 5149ef30 4293733c
Table 2 Two pairs of collision, where i=11 and these two examples differ only at the last word
3 Collisions for MD4
MD4 is designed by R. L. Rivest[8] . Attack of H. Dobbertin in Eurocrypto'96[2] can find collision with
probability 1/222. Our attack can find collision with hand calculation, such that
) 0 , 0 , 0 , 2 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 2 2 , 2 , 0 ( , 16 31 28 31 C C M M
and ) ( 4 ) ( 4 M MD M MD .
M1
4d7a9c83 56cb927a b9d5a578 57a7a5ee de748a3c dcc366b3 b683a020 3b2a5d9f
c69d71b3 f9e99198 d79f805e a63bb2e8 45dd8e31 97e31fe5 2794bf08 b9e8c3e9
M1
4d7a9c83 d6cb927a 29d5a578 57a7a5ee de748a3c dcc366b3 b683a020 3b2a5d9f
c69d71b3 f9e99198 d79f805e a63bb2e8 45dc8e31 97e31fe5 2794bf08 b9e8c3e9
H 5f5c1a0d 71b36046 1b5435da 9b0d807a
M2
4d7a9c83 56cb927a b9d5a578 57a7a5ee de748a3c dcc366b3 b683a020 3b2a5d9f
c69d71b3 f9e99198 d79f805e a63bb2e8 45dd8e31 97e31fe5 f713c240 a7b8cf69

4d7a9c83 d6cb927a 29d5a578 57a7a5ee de748a3c dcc366b3 b683a020 3b2a5d9f
c69d71b3 f9e99198 d79f805e a63bb2e8 45dc8e31 97e31fe5 f713c240 a7b8cf69
H e0f76122 c429c56c ebb5e256 b809793
Table 3 Two pairs of collisions for MD4
4 Collisions for RIPEMD
RIPEMD was developed for the RIPE project (RACE Integrrity Primitives Evalustion, 1988-1992). In
1995, H. Dobbertin proved that the reced version RIPEMD with two rounds is not collision-free[4]. We show
that the full RIPEMD also isnOt collision-free. The following are two pairs of collisions for RIPEMD:
) 2 , 0 , 0 , 0 , 0 , 2 2 , 0 , 0 , 0 , 0 , 0 , 0 , 2 , 0 , 0 , 0 ( , 31 31 18 20 ' C C M M i i
M1
579faf8e 9ecf579 574a6aba 78413511 a2b410a4 ad2f6c9f b56202c 4d757911
bdeaae7 78bc91f2 47bc6d7d 9abdd1b1 a45d2015 817104ff 264758a8 61064ea5
M1
579faf8e 9ecf579 574a6aba 78513511 a2b410a4 ad2f6c9f b56202c 4d757911
bdeaae7 78bc91f2 c7c06d7d 9abdd1b1 a45d2015 817104ff 264758a8 e1064ea5
H 1fab152 1654a31b 7a33776a 9e968ba7
M2
579faf8e 9ecf579 574a6aba 78413511 a2b410a4 ad2f6c9f b56202c 4d757911
bdeaae7 78bc91f2 47bc6d7d 9abdd1b1 a45d2015 a0a504ff b18d58a8 e70c66b6

579faf8e 9ecf579 574a6aba 78513511 a2b410a4 ad2f6c9f b56202c 4d757911
bdeaae7 78bc91f2 c7c06d7d 9abdd1b1 a45d2015 a0a504ff b18d58a8 670c66b6
H 1f2c159f 569b31a6 dfcaa51a 25665d24
Table 4 The collisions for RIPEMD
5 Remark
Besides the above hash functions we break, there are some other hash functions not having ideal security. For
example, collision of SHA-0 [6] can be found with about 240 computations of SHA-0 algorithms, and a collision
for HAVAL-160 can be found with probability 1/232.
Note that the messages and all other values in this paper are composed of 32-bit words, in each 32-bit word
the most left byte is the most significant byte.
1 B. den Boer, Antoon Bosselaers, Collisions for the Compression Function of MD5, Eurocrypto,93.
2 H. Dobbertin, Cryptanalysis of MD4, Fast Software Encryption, LNCS 1039, D. , Springer-Verlag, 1996.
3 H. Dobbertin, Cryptanalysis of MD5 compress, presented at the rump session of EurocrZpt'96.
4 Hans Dobbertin, RIPEMD with Two-round Compress Function is Not Collision-Free, J. Cryptology 10(1),
1997.
5 H. Dobbertin, A. Bosselaers, B. Preneel, "RIPMEMD-160: A Strengthened Version of RIPMMD," Fast
Software EncrZption, LNCS 1039, D.Gollmann, Ed., Springer-Verlag, 1996, pp. 71-82.
6 FIPS 180-1, Secure hash standard, NIST, US Department of Commerce, Washington D. C., April 1995.
7 P. R. Kasselman, W T Penzhorn , Cryptananlysis od reced version of HAVAL, Vol. 36, No. 1, Electronic
Letters, 2000.
8 R. L. Rivest, The MD4 Message Digest Algorithm, Request for Comments (RFC)1320, Internet Activities
Board, Internet Privacy Task Force, April 1992.
9 R. L Rivest, The MD5 Message Digest Algorithm, Request for Comments (RFC)1321, Internet Activities
Board, Internet PrivacZ Task Force, April 1992.3RIPEMD-1281
10 Y. Zheng, J. Pieprzyk, J. Seberry, HAVAL--A One-way Hashing Algorithm with Variable Length of Output,
Auscrypto'92.