DataTerminology.comNEW
A 128-bit hash function published in 1992 that is now broken due to practical collision attacks.
DESCRIPTION
MD5 (Message-Digest Algorithm 5) was widely used for integrity and signatures but is no longer secure because collisions can be constructed efficiently. Defined by RFC 1321, MD5’s weaknesses are documented in RFC 6151, and its use is discouraged or disallowed in many standards. Today, MD5 may appear only in non-security contexts or legacy systems, but modern practice favors SHA-2 or SHA-3 and strong KDFs for passwords.
ALTERNATIVE DEFINITIONS
IETF RFC 1321
The MD5 message-digest algorithm takes as input a message of arbitrary length and produces as output a 128-bit “fingerprint” or “message digest” of the input.
Canonical definition of MD5’s function and output length.
IETF RFC 6151
MD5 and HMAC-MD5 have been found to be vulnerable in some situations; this document updates the security considerations for MD5 and HMAC-MD5.
Explicitly updates security guidance, noting vulnerabilities.
NIST
NIST-approved secure hash algorithms exclude MD5 due to its known collision vulnerabilities; agencies should transition to approved hashes.
Clarifies disallowing MD5 in approved secure hash algorithms.
RELATED TERMS
Hash Function SHA-1 Collision Attack HMAC-MD5 Digital Signature Checksum RFC 1321 RFC 6151
COMPETING TERMS
KNOWLEDGE AREAS
Data Security Software Engineering
TARGET AUDIENCE
Software Developer Security Architect Cybersecurity Engineer Chief Information Security Officer
EXTERNAL SOURCES
- Wikipedia - MD5
- IETF - Original MD5 specification
- IETF - Security considerations update for MD5
- NIST - NIST hash function guidance
TOP QUESTIONS
Why is MD5 considered broken?
Practical collision attacks exist, enabling two different inputs to produce the same digest, undermining integrity and signatures.
Category: Understanding
Where was MD5 historically used?
In digital signatures, file integrity checks, and certificates before being replaced by stronger hashes.
Category: Example
Is HMAC-MD5 safe?
HMAC construction mitigates some weaknesses, but MD5-based HMAC is generally discouraged in favor of HMAC-SHA-256 or better.
Category: Opinion
Can MD5 be used for non-security checksums?
It’s discouraged; safer modern hashes like SHA-256 are widely available with minimal performance overhead.
Category: BestPractices
What are recommended replacements for MD5?
SHA-256, SHA-3, or BLAKE2/3 depending on requirements and standardization needs.
Category: Alternatives
When was MD5 published?
MD5 was published in 1992 in RFC 1321 by Ronald L. Rivest.
Category: Origin
Are MD5-signed certificates accepted today?
No. Certificate authorities and browsers reject MD5 signatures due to collision attacks.
Category: Regulation
Does salting fix MD5’s weaknesses?
No. Salting stops precomputation attacks but does not restore collision resistance; use stronger hashes.
Category: Misunderstanding
Is MD5 suitable for password hashing?
No. Use slow, memory-hard KDFs like Argon2, scrypt, or PBKDF2 with SHA-256 or SHA-512.
Category: BestPractices