Summary

  • RFC 1321, published in April 1992, specified MD5 and included a portable C reference implementation, a driver and seven expected test outputs. Those parts let implementers compare a running program with a common computational target.
  • The 2011 update, RFC 6151, changed the security assessment: MD5 was no longer acceptable where collision resistance was required, including digital signatures. The old test results still described the old algorithm exactly.

A specification with homework already marked

Most people encounter a hash as a line of mysterious hexadecimal. RFC 1321 began further upstream. It told a programmer how to turn an arbitrarily long message into 128 bits: pad the message to a precise boundary, append its original length, initialize four 32-bit words and process the input in 512-bit blocks. The details matter because two programs that disagree about one byte order or one padding bit will print different answers for the same input. A description alone leaves plenty of room for a charmingly wrong implementation.

Rivest supplied a way to catch that sort of error. Appendix A carried four C files: global.h, md5.h, md5c.c and mddriver.c. The last file was a driver that could digest strings, files or standard input, and its -x option ran a fixed test suite. Appendix A.5 printed the expected results for seven inputs, beginning with the empty string, then a, abc and several longer sequences. For abc, the expected digest is 900150983cd24fb0d6963f7d28e17f72. A reader could type three letters, run the program and compare its output with the page. The answers were in the back because the exam was interoperability.

The reference implementation came from RSAREF, a cryptographic toolkit for Privacy-Enhanced Mail. Its presence in the RFC shortened the distance between specification and execution. A team writing a new implementation could follow the prose, compare results with the supplied code and test known outputs. A team porting the sample could catch a mistake before two correspondents exchanged data that only one side understood. The RFC called the implementation portable and even suggested a little-endian optimization. It gave programmers a concrete baseline to run on their own machines.

The timing also explains the pitch. MD5 extended MD4. The 1992 memo said MD4 might have been adopted faster than critical review justified and described MD5 as a more conservative design, giving up some speed for what its author expected to be a greater margin of security. The algorithm was intended for digital-signature applications, where a large file could be reduced to a digest before a private-key operation. The memo was Informational and placed MD5 in the public domain for review and possible adoption as a standard. A reader in 1992 was being handed both a proposed security argument and a practical path to running it.

Those are two different gifts. The C files and seven vectors made the computation checkable. They told a programmer whether an implementation agreed with the specified MD5 result for those inputs. The original conjecture about hard-to-find collisions required a different kind of scrutiny: analysis of what an adversary could arrange. A student can get every answer at the back of a textbook right while the textbook’s theory is still due for revision.

By March 2011, an official revision had done just that. RFC 6151 updated the security considerations of RFC 1321 after published attacks on MD5. Its conclusion was direct: MD5 was unacceptable in applications requiring collision resistance, such as digital signatures. The document separately discussed uses with different requirements, including HMAC-MD5 and checksums used solely to detect accidental errors, and advised new protocol designs away from HMAC-MD5. The old bytes had not changed; the security value assigned to a matching digest had.

That distinction is the hinge of the story. The seven test outputs remain good instructions for reproducing MD5. Two implementations that produce the same digest for the suite have passed those particular checks. Deliberately constructed colliding messages pose another test entirely. The later RFC changed what a digital-signature system should trust by revising the claim surrounding the computation; the old md5c.c listing could stay on the page.

The document pair makes a useful time capsule of Internet standardization. RFC 1321 put an algorithm, executable reference and expected observations on one public page. It gave implementers something more useful than “please do the right thing”: a concrete target they could run. RFC 6151 showed that targets can outlive the security stories first attached to them. A correct MD5 program in 2011 was still a correct MD5 program. That was no longer enough to choose MD5 for a signature.