MD5.java doesn't match md5sum

[Migrated From Jforum.net]

I don't know if this is supposed to happen (maybe you just wanted to hash a string ) but your MD5.java does not produce the same hash as md5sum.

Example:

mac:~ espectro$ echo hola | md5sum
916f4c31aaa35d6b867dae9a7f54270d -

mac:~ espectro$ java md5 hola
4d186321c1a7f0f354b297e8914ab240

I changed your function to be called as a standalone program, reading
the string to has from args[0] for this test.

If somehow your MD5 code collides, this may be exploitable.
I know MD5 has been broken, but since you are producing a different
hash who knows how much tries would take to find a collision in your code
[originally posted on jforum.net by Anonymous]

[Migrated From Jforum.net]

I found another implementation.

http://cvs.apache.org/viewcvs.cgi/maven/src/java/org/apache/maven/util/MD5Sum.java?rev=1.13&view=markup

It is in apache maven. You may want to test it
[originally posted on jforum.net by Anonymous]

[Migrated From Jforum.net]

Well, if my md5 code is wrong, then all java.security stuff is also wrong, since it uses java.security.MessageDigest. I have been using this md5 code for a long time (well, it's not *my* implementation, since you can find it in the web), even in integration applications (aka, migrating from php, for example), and it worked nice.

Rafael
[originally posted on jforum.net by Rafael Steil]

[Migrated From Jforum.net]

If there is something wrong with the code, it sure isn't md.update() or md.digest().

I would think the error is inside the for loop.
I am highly curious in knowing why Java doesn't provide a simple method to get a hashed string with MD5.

I don't really understand why we have to mess with bytes and hexadecimal stuff. When i started implementing this, i thought i just needed to call md.update(String), then md.digest() and just convert the bytes to a string.

This is the code of the critic stuff in maven:

for ( int i = 0; i < 16; i++ )
        {
            int low = ( binaryData[i] & 0x0f );
            int high = ( ( binaryData[i] & 0xf0 ) >> 4 );
            buffer[i * 2] = hexadecimal[high];
            buffer[i * 2 + 1] = hexadecimal[low];
        }

and this the one in JForum:

for (int i = 0; i < hash.length; i++) {
    if ((0xff & hash[i]) < 0x10) {
        hexString.append("0" + Integer.toHexString((0xFF & hash[i])));
    }                
    else {
        hexString.append(Integer.toHexString(0xFF & hash[i])); 
    }                
}

[originally posted on jforum.net by Anonymous]

[Migrated From Jforum.net]

I made a test program, and the output was the same for both libraries. Take a look in the attached file.


[originally posted on jforum.net by Rafael Steil]

[Migrated From Jforum.net]

I think i found the answer. I found this :

Comparing the output of the above code to the output of the md5sum command, the results are completely different. Why should this be?

Couple of possible reasons.
1) The default character encoding on your machine is not "CP1252"
The java program specifies this charset when getting the bytes of the message.

To figure out your default character set, you can call:
System.getProperty("file.encoding")

If you replace the "CP1252" string in the test program with the above call, it should work.

Unless...
2) You are sending md5sum a file and your file has a newline in it. The java program
is sending just the text "Hello, world!" (with no trailing characters)

Make sure there's no newline in you file by using the -n flag to echo. (there should only be 13 chars)

Indeed, i was using echo without the -n. Sorry for this

[originally posted on jforum.net by Anonymous]

[Migrated From Jforum.net]

heheh.. that's ok

Rafael
[originally posted on jforum.net by Rafael Steil]