Alternative data hashing: md5() - Practical PHP Programming

This is NOT the latest copy of this book; click here for the latest version.

string md5 ( string source [, bool raw_output])

Although the sha1() function is recommended for hashing data securely, another popular algorithm is MD5, where the "MD" for Message Digest. The md5() function produces a data hash in exactly the same way as sha1(), with the difference is that it is only 32-bytes long. Because sha1() is longer, it is less likely to have a "collision" - a situation where two different strings share the same hash. However, md5() has a slight speed advantage.

Using md5() is the same as using sha1():

<?php

      $md5hash = md5("My string");

      print $md5hash;
 ?>

Note if you are thinking having fewer bits in MD5 makes it less secure, you are correct - but only just. An MD5 hash is 32 bytes long, which is equal to 128 bits. That is, an MD5 hash can be made up of 3.4028236692093846346337460743177e+38 different possibilities, more commonly referred to as 2 to the power of 128. This an enormous number of varieties, and so is quite secure for most purposes.

A PHP User - 30 Aug 2008

There isn't that much of a speed difference.

TEST MACHINE:
1.8 GHz Pentium 4 running PHP 5.

TIME RESULTS (looping one million times each):

sha1: 3.01 seconds
md5: 2.62 seconds

kewlceo - 30 Aug 2008

Since many people insist on using common dictionary words for there passwords, it's good practice to insist on a combination of letters and numbers when they create their pw.

Alternatively, add some random data to the chosen pw (this is known as a 'salt') to prevent dictionary-based attacks.

A PHP User - 30 Aug 2008

Also, there are more resources (e.g. rainbow tables) for cracking MD5, it is best to stick with SHA1 or even better write a script for another less known hashing algorithm.

Add comment
Please note that by posting a comment here you are committing it to the public domain. This is important so that others can make use of your code themselves, and also so that I can incorporate helpful notes directly into the main text. Comments are limited to 2000 characters in length.

If you are reporting an error in the content, please tell me directly.

4.7.11 Alternative data hashing: md5()

This is NOT the latest copy of this book; click here for the latest version.