How can it be impossible to “decrypt” an MD5 hash? [duplicate]

Answer 1

Also, since multiple strings can create the same MD5 hash, due to it being less data than the input string, how would any other hashing system be any better?

An attack is known against MD5 which makes it possible for the attacker to create multiple documents with different contents but the same MD5 hash. This attack is computationally feasible, and as a demonstration, is was used to "predict" the outcome of a presidential election. (The attacker published a hash before the election, then afterward revealed a document with that hash giving the winner's name. But actually the attacker had a document for each candidate, all with the same hash.)

A better system would provide a cryptographic guarantee, that it is computationally intractable to create two distinct documents that hash to the same value. SHA-1 may be such a system.

An even worse system would allow an attack whereby given access to any hash, you could create a document with that hash. The venerable CRC system, which is still used in many hardware systems (think Ethernet), is vulnerable to this attack. Like MD5, it is a hash function in which the output is not reconstructable from the input, but given any output, it is trivial to construct a document with a given CRC-32 or CRC-64 signature. Worse, you can put any text you like in such a document, then get the CRC you want just by adding junk at the end.

It's no coincidence that CRC-32 can be computed very quickly, MD5 takes significantly longer, and SHA-1 takes somewhat longer than that. Both the cost models and the trust models are difficult.

A really good hash function would be as quick to compute as CRC and as difficult to construct two documents hashing to the same value as SHA-1. Don't hold your breath...

Answer 2

Basically it's because the output of MD5 contains less information than the input. This is basically what distinguishes a hash algorithm from an encryption algorithm.

Here's a simple example: imagine an algorithm to compute the hash of a 10-digit number. The algorithm is "return the last 2 digits." If I take the hash of 8023798734, I get 34, but if all you had is the 34, you would have no way to tell what the original number is because the hashing algorithm discarded 8 digits worth of information. It's similar with MD5, except that the hash is computed via a complex procedure instead of just chopping off part of the data.

So then how can one hash be better than another? For one thing, different hash algorithms can be more or less resistant to collisions (when two inputs produce the same output). The probability of a collision is inversely related to the number of possible hash outputs. Collisions are an undesirable feature of hashes because if your data changes, you want the hash to change too, so one way to get a better hash algorithm is to use a hash with more possible outputs. In the digits example above, taking the last 4 digits instead of the last 2 digits reduces the probability of a collision with a given hash (technically called a preimage) to 1 in 10000 instead of 1 in 100, so it's more likely that all the 10-digit numbers in whatever set you have will have different hash values.

There's also the issue of cryptographic security. When you want to use a hash to make sure that some data is not tampered with, it's desirable that whoever's doing the tampering can't predict what inputs will produce a given output. If they could, they would be able to alter the input data in such a way that the output (the hash) remains the same. Going back to the digits example again, let's say I'm going to email you the number 1879483129 and it is critically important that this number gets to you unaltered. I might call you up and tell you the hash of the number, which would be 29, but since the "last 2 digits" algorithm is not cryptographically secure, a nefarious hacker could change the number en route to, say, 5555555529 and you wouldn't know the difference.

It's been shown that MD5 is not cryptographically secure (and SHA-1 is also compromised). That means that it is possible to find different inputs which correspond to any given output. It's still a fine algorithm for protecting against random bit flips and the like, but if there's a chance someone might want to intentionally corrupt your data, you should really use something more secure, like SHA-256 or greater, probably as part of an HMAC scheme.

Answer 3

The entropy of the string increases, as some information is lost during the hashing process. This means that there is not enough information available to reconstruct the original string.

Answer 4

Here's a simple answer...

There are a finite number of hash values, and an infinite number of hashable, plaintext values.

Therefore, reversing a given MD5 hash would result in an infinite number of possible plaintext values.

Answer 5

Hmm, not to be rude, but it seems to me that all the answers about "less information coming out than going in" miss the point.

The main use of MD5, and similar cryptographic hash codes, is to encrypt passwords. In that case, I don't care whether it's possible to reconstruct the original string. All I care is whether I can construct any string that would hash to the same value.

Take a simplified example: Suppose our hash algorithm was "take the last two digits". So if my password is "12345678", the hash code is "78". Is there any way to go from "78" back to "12345678"? No. But if I'm hacking passwords, I don't care if I know what your original password was. I just want a password to let me in. So if I knew this was the algorithm, I'd say great, I'll use the password "99978". It hashes to "78", so the password validation algorithm will pass it, and I'm in.

Obviously MD5 is much more difficult to reverse, even in this "anything that will hash to the right value" sense, then a simplistic algorithm like "take the last two digits". But is it literally impossible? That puzzles me, too. So sure, information is discarded along the way. But couldn't I reverse to to an "any" value by filling in any random value at any point where information is discarded? I haven't looked at the actual algorithm for MD5. I presume it's not something easy to reverse, like change all the pluses to minues or something trivial like that, or somebody would have done it a long time ago. From the fact that there are millions of hackers out there who have tried to crack this, even if it is theoretically possible, it must be incredibly difficult.

Answer 6

I just can't understand how you convert something to one thing using some algorithm, and there being no way to convert it back using the algorithm in reverse.

You can turn a cow into hamburger, but you cannot turn hamburger into a cow.

The transformation reduces data that exists by destroying it, and that data cannot be recovered.