Secure Hash Functions (MD4, MD5, SHA-1)

The MD4, MD5 and SHA-1 algorithms are secure hash functions. They take a string input, and produce a fixed size number - 128 bits for MD4 and MD5; 160 bits for SHA-1. This number is a hash of the input - a small change in the input results in a substantial change in the output.

The functions are thought to be secure, in the sense that it would require an enormous amount of computing power to find a string which hashes to a chosen value. In others words, there's (almost) no way to decrypt a secure hash. The uses of secure hashes include digital signatures and challenge hash authentication.

View:

Usually you'll want to get the result in hexadecimal, so it can be submitted as part of a form without worrying about URL encoding. 

<script type="text/javascript">
 hash = hex_md4("input string");
 hash = hex_md5("input string");
 hash = hex_sha1("input string");
</script>

Note that the input must be a string - hex_md5(Math.random()) will not function correctly; you must do hex_md5(Math.random().toString()).

You can also get the result in base-64 encoding: 

<script type="text/javascript">
 hash = b64_md4("input string");
 hash = b64_md5("input string");
 hash = b64_sha1("input string");
</script>

You can also get the result as a binary string. This representation is useful when you want to feed the result of a hash operation back into another operation. The ability to do this lets you create a variety of cryptographic protocols. For example, to do a double hash: double_hash = hex_md5(str_md5(data)); The string is encoded so each character of a string represents either one or two bytes, in ASCII and UniCode respectively. This would be troublesome to send over HTTP as form data, but JavaScript strings are completely binary safe.

In many uses of hashes you end up wanting to combine a key with some data. It isn't so bad to do this by simple concatonation, but HMAC is a carefully designed method, known to be very secure. The usage is:

<script type="text/javascript">
 hash = hex_hmac_md4("key", "data");
 hash = hex_hmac_md5("key", "data");
 hash = hex_hmac_sha1("key", "data");
</script>

There are a few configurable variables; you may have to tweak these to be compatible with the hash function on the server.

hexcaseThe case of the letters A-F in hexadecimal:
  • output 0 - lower case (default)
  • 1 - upper case
b64padThe character used to pad base-64 output to a multiple of 3 bytes
  • "" - no padding (default)
  • "=" - for strict RFC compliance
chrszWhether string input should be treated as ASCII or UniCode
  • 8 - ASCII (default)
  • 16 - UniCode

To set a variable, use a syntax like this: 

<script type="text/javascript">
   chrsz = 16;
</script>
In general, it's ok to change the values of these variables between calls to the library; for example you can do ASCII and UniCode hashes on the same page. However, you can't change chrsz and then re-use data returned by a str_* function.

To see working example of these functions, visit WebTNG Hash Calculator tool page.

Labels: , ,