MD5 Hash Online Generador

Linux distros such as CentOS (v6.3 i.e.) are using a specific boot manager such as "GRUB", which contains a .conf file where you can edit your user information such as your password etc.

the password must be encrypted using MD5 (i.e. : Password --md5 kw485/fgf$&e), and that is a little bit confusing.

Assuming that the MD5 is a one way encrypting method and that encrypting the same string will always give a newly generated string.

How can the system compare the two passwords since they'll never match ?

here is an example :

grub> md5cryptmd5cryptPassword: hellohelloEncrypted: $1$95Uz30$X/u7PX4F5GtEOsMguDDq10grub> md5cryptmd5cryptPassword: hellohelloEncrypted: $1$H8Uz30$LwAkSMZBYC07zJbx3lIVa1

as you can see we have inserted the same string and got two different results, assuming that's how a login scenario should happen such as :

$ login userpassword : hello

• hello will be translated to $1$H8Uz30$LwAkSMZBYC07zJbx3lIVa1 hashedpassword in grub.conf is $1$95Uz30$X/u7PX4F5GtEOsMguDDq10 that's afailed login attempt.

Recently, I was studying the source code of MD5 from https://tls.mbed.org/md5-source-code.

And, I came across some puzzling codes in https://github.com/ARMmbed/mbedtls/blob/master/library/md5.c#L266.

int mbedtls_md5_starts_ret( mbedtls_md5_context *ctx ){    ctx->total[0] = 0; // initialized to 0    ctx->total[1] = 0;    ......}int mbedtls_md5_update_ret( mbedtls_md5_context *ctx,                            const unsigned char *input,                            size_t ilen ){    ......    left = ctx->total[0] & 0x3F;    ......}

ctx->total[0]andctx->total[1]denote the number of bytes processed, and initially they are both initialized to 0, but, why use & operate with ctx->total[0](its value is 0)?

When user logs in with remember me checked, I create a random token using md5 for the cookie.

md5(uniqid(rand(), true));

I append users IP address to their unique user_id and hash that using bcript. (I DO NOT ADD THIS TO THE COOKIE) I store the bcript hash and random token that uses md5 along with their user id into a table. The row will have an auto increment value. The cookie contains the md5 and the auto increment value appended to it.

When the user visits the website, I take the auto increment value of the cookie to look up the md5 hash. If there is a match I hash the users IP address along with the user_id (that was stored in the table) and see if it matches the hash value stored in the same row. If it does they are logged in and I create another md5 hash for their cookie.

I know md5 isn't secure on its own, but I wondered if the extra steps I take with the brcript and IP address makes it safe, or anyone can see some massive security holes in this.

edit: I'll just add that when using Bcript for the ip and user_id, I'm using the php function password_hash that also creates a salt.

this is my code in C# :

    public static String MD5Encrypt(String str, Boolean raw_output=false)    {        // Use input string to calculate MD5 hash        String output;        MD5 md5 = System.Security.Cryptography.MD5.Create();        byte[] inputBytes = System.Text.Encoding.ASCII.GetBytes(str);         byte[] hashBytes = md5.ComputeHash(inputBytes);        // Convert the byte array to hexadecimal string        StringBuilder sb = new StringBuilder();        for (int i = 0; i < hashBytes.Length; i++)        {            sb.Append(hashBytes[i].ToString("x2"));        }        output = sb.ToString();        if (raw_output)        {            output = pack(output);        }        return output;    }    public static String pack(String S)    {        string MultiByte = "";         for (int i = 0; i <= S.Length - 1; i += 2)        {            MultiByte += Convert.ToChar(HexToDec(S.Substring(i, 2)));        }        return MultiByte;    }    private static int HexToDec(String hex)    {        //Int32.Parse(hexString, System.Globalization.NumberStyles.HexNumber);        return Convert.ToInt32(hex, 16);    }

To reproduce what is done in php by this way :

md5($str, true);

OR

pack('H*', md5( $str ));

I tried many things but can't get the same on the two sides in some cases of word.For example, Trying this test on the string "8tv7er5j"

PHP Side :

9c36ad446f83ca38619e12d9e1b3c39e <= md5("8tv7er5j");œ6­DoƒÊ8ažÙá³Ãž <= md5("8tv7er5j", true) or pack("H*", md5("8tv7er5j"))

C# Side :

9c36ad446f83ca38619e12d9e1b3c39e <= MD5Encrypt("8tv7er5j")6­DoÊ8aÙá³Ã <= MD5Encrypt("8tv7er5j", true) or pack( MD5Encrypt("8tv7er5j") )

Why ? Encoding problem ?

EDIT 1 :I have the good result, but bad encoded with this this function for pack() :

if ((hex.Length % 2) == 1) hex += '0';byte[] bytes = new byte[hex.Length / 2];for (int i = 0; i < hex.Length; i += 2){    bytes[i / 2] = Convert.ToByte(hex.Substring(i, 2), 16);}return bytes;

So, System.Text.Encoding.UTF8.GetString(bytes) give me :�6�Do��8a���Þ

And System.Text.Encoding.ASCII.GetString(bytes)?6?Do??8a??????

...

In my app, I download videos from the Amazon S3 cloud to the sandbox. In order to make sure that the downloaded files are not corrupt, I compare the eTag of the object (delivered by Amazon) with the MD5 hash of the downloaded object which resides in the local file system. For small videos (< 5MB) my algorithm works fine - eTag and MD5 hash are identical.

For bigger files, both parameters no longer match - as far as I know, Amazon generates the eTag differently for files > 5MB - the eTag also has a trailing hyphen with a number behind (maybe it's the number of chunks?):

8c18c4ed68bc9db377cb2d3225c0ee31-4

In the Internet, I could find no solution or code snippet calculating the correct MD5 hash for bigger files.

Calculating the MD5 hash, I tried both

localData.md5().toHexString() // CryptoSwift

both

var md5: String? {   let hash = localData.withUnsafeBytes { (bytes: UnsafePointer<Data>) -> [UInt8] in   var hash: [UInt8] = [UInt8](repeating: 0, count: Int(CC_MD5_DIGEST_LENGTH))   CC_MD5(bytes, CC_LONG(localData.count), &hash)       return hash   }   return hash.map { String(format: "%02x", $0) }.joined()}

Has anyone an idea how to resolve this?Maybe I should focus on another approach - for example checking if the downloaded video can be opened?