The Curious Case of MD5

Original Article ↗ Hacker News Discussion ↗

MD5, a decades‑old cryptographic hash function long considered “broken” for security, is still widely used in fields like digital forensics, law, genomics, and cloud storage to identify files and check integrity. Commenters debate whether this is acceptable given that MD5 is vulnerable to collision attacks (where two different inputs share a hash) but still believed to be resistant to more demanding second‑preimage attacks, and note that many real‑world workflows rely more on legal process and context than on cryptographic guarantees. Others argue that continuing to use MD5 is needless technical debt when faster, stronger, and NIST‑approved alternatives such as SHA‑2, SHA‑3, or BLAKE3 are broadly available and easy to adopt.

Role of MD5 Today

  • Many commenters still use MD5 as a fast, ubiquitous 128‑bit checksum for file integrity, deduplication, and IDs, explicitly not as a cryptographic hash.
  • Others argue that “checksum” uses can quietly become security‑relevant over time, so it’s safer to default to a modern cryptographic hash.

Collisions, Birthday Bounds, and Preimage Attacks

  • Repeated clarification that MD5 is badly broken for collision resistance (easy to create two different inputs with the same hash), with numerous practical demos (PDF/NES hybrid, image “quines,” etc.).
  • Distinction emphasized between:
    • Collision attacks: attacker controls both messages.
    • Second preimage attacks: attacker must find a new message colliding with a given one; these remain vastly harder and are not currently practical for MD5.
  • Some confusion over the birthday problem (whether ~2^64 vs 2^128 trials are needed for 128‑bit collisions); multiple replies explain the standard 2^64 birthday bound but also note storage/algorithmic constraints for actually finding collisions in practice.

Performance and Alternative Hashes

  • Several posts claim MD5 is faster; others counter that on modern CPUs with SHA instructions, SHA‑256 can match or exceed MD5, especially in common toolchains using OpenSSL.
  • Proposed alternatives by use case:
    • SHA‑256 (and truncated SHA‑256) as a near‑drop‑in replacement, widely supported, NIST‑approved.
    • SHA‑3 and BLAKE2/BLAKE3 for stronger properties or parallelism, though SHA‑3 lacks widespread hardware acceleration.
    • Non‑crypto checksums (CRC32, Adler32) deemed fine only for short‑range error detection, not large‑scale file identification.

Legal and Forensic Context

  • Many legal/forensics practitioners treat MD5 as one element in a broader evidentiary process; chain of custody is enforced primarily by legal rules, not math.
  • Consensus that forged evidence hinges more on human factors, system access, and narrative plausibility than on hash choice alone.
  • Some argue MD5’s known weakness could undermine perceived evidentiary weight, and that future attacks or precedent‑setting cases could force a rushed migration; others think the real‑world risk is minimal and manageable.

Entrenchment, Usability, and Pragmatism

  • MD5 persists in ecosystems like genomics, piracy archives, dedup tools, Azure Blob integrity checks, and even password storage in some software.
  • Switching costs, compatibility, and MD5’s shorter 32‑hex output are cited as practical reasons it lingers.
  • Several commenters argue: since secure hashes are “cheap enough” and mis‑threat‑modeling is common, the simplest rule is to stop defending MD5 and just use a modern hash everywhere.