Cryptography and System Security Lab
Experiment 4
Aim: For varying message sizes, test integrity of message using MD-5, SHA-1, and analyse the
performance of the two protocols. Use crypt APIs.
Theory:
Introduction
In modern communication systems, data integrity is one of the most important security
requirements. Data transmitted over insecure channels may be modified, either accidentally due
to noise and transmission errors, or deliberately due to malicious attacks. To ensure that a
received message is exactly the same as the one sent, cryptographic hash functions are widely
used.
A cryptographic hash function takes an input message of arbitrary size and produces a
fixed-length digest (hash value). This digest acts as a fingerprint of the original message. Even
the slightest change in the message results in a completely different hash value. For verifying
message integrity, the sender computes the hash of the message and transmits both the message
and hash. The receiver recomputes the hash on the received message and compares it with the
transmitted hash. If they match, the message integrity is preserved.
Two widely used hash functions are MD-5 (Message Digest 5) and SHA-1 (Secure Hash
Algorithm 1). Although both have been found to be weak against strong cryptanalysis, they are
still studied extensively in academic and experimental settings, especially for analyzing their
performance and behavior under varying input sizes.
MD-5 Algorithm
MD-5 was designed by Ronald Rivest in 1991. It produces a 128-bit hash value from an
arbitrary-length message.
● Digest Size: 128 bits (16 bytes).
● Processing: Works on 512-bit blocks of input, padding the message if necessary.
● Usage: Traditionally used in checksums, password hashing, and file integrity checking.
● Limitations: Vulnerable to collision attacks (two different messages producing the same
hash).
Despite its vulnerabilities, MD-5 remains popular in applications where high security is not the
primary concern, but fast computation is required.
SHA-1 Algorithm
SHA-1 was designed by the National Security Agency (NSA) and standardized by NIST in 1995.
It produces a 160-bit hash value.
● Digest Size: 160 bits (20 bytes).
● Processing: Operates on 512-bit blocks, applying padding and then iterative rounds of
compression functions.
● Usage: Used in digital signatures, SSL/TLS certificates, and file integrity verification.
● Limitations: Cryptanalysis has shown practical collision attacks, making it unsuitable for
modern cryptographic security.
Even though SHA-1 is stronger than MD-5, it is also slower due to its more complex operations.
Use of Cryptographic APIs
To perform integrity testing in real environments, cryptographic APIs such as Java
Cryptography Architecture (JCA), Python’s hashlib, or OpenSSL libraries are used. These
APIs provide functions to compute digests for given messages of varying sizes (small text files,
large documents, or binary data).
The general process of testing message integrity is as follows:
1. Prepare messages of different sizes (e.g., 1 KB, 10 KB, 100 KB, 1 MB, etc.).
2. Use the cryptographic API to compute MD-5 and SHA-1 digests for each message.
3. Compare the computation time required for each algorithm.
4. Verify that altering even a single bit in the message results in a completely different hash
value, confirming integrity detection.
Performance Analysis
When analyzing MD-5 and SHA-1, two main parameters are considered:
1. Computation Speed:
○ MD-5 generally computes faster due to its smaller digest size (128 bits).
○ SHA-1 is slightly slower because of its additional rounds of computation and
longer digest size (160 bits).
2. Collision Resistance and Security Strength:
○ MD-5 is highly vulnerable to collisions and is considered broken.
○ SHA-1 is stronger but still vulnerable; collision attacks have been practically
demonstrated.
3. Scalability with Message Size:
○ Both MD-5 and SHA-1 process input in 512-bit blocks, so performance scales
linearly with message size.
○ For very large files, SHA-1 takes longer due to increased processing complexity.
4. Practical Observations using Crypt APIs:
○ For small messages, the performance difference is negligible.
○ For medium to large files, MD-5 consistently outperforms SHA-1 in terms of
computation time.
○ However, SHA-1 provides slightly better integrity guarantees due to its longer
digest size.
Summary of Analysis
● MD-5 is faster and produces smaller digests but is cryptographically insecure.
● SHA-1 is slower but provides better integrity checking due to larger digest size.
● Both algorithms are suitable for academic performance comparison but are not
recommended for secure applications. Modern alternatives such as SHA-256 and SHA-3
are now widely used.
Implementation:
import hashlib, timeit
md5_val = md5_hash(msg, salt)
msg = "Today is monday" md5_time = timeit.timeit(lambda:
salt = "somesalt" md5_hash(msg, salt), number=1000)
sha256_val = sha256_hash(msg, salt)
def md5_hash(msg, salt): sha256_time = timeit.timeit(lambda:
return f"$1${salt}${hashlib.md5((salt + sha256_hash(msg, salt), number=1000)
msg).encode()).hexdigest()}" sha512_val = sha512_hash(msg, salt)
sha512_time = timeit.timeit(lambda:
def sha256_hash(msg, salt): sha512_hash(msg, salt), number=1000)
return f"$5${salt}${hashlib.sha256((salt
+ msg).encode()).hexdigest()}" print("MD5 →", md5_val)
print("SHA-256 →", sha256_val)
def sha512_hash(msg, salt): print("SHA-512 →", sha512_val)
return f"$6${salt}${hashlib.sha512((salt print(f"MD5 Time: {md5_time:.6f} sec")
+ msg).encode()).hexdigest()}" print(f"SHA-256 Time: {sha256_time:.6f}
sec")
print(f"Message: {repr(msg)}\n") print(f"SHA-512 Time: {sha512_time:.6f}
sec")
Output:
Conclusion:
The study of message integrity testing using MD-5 and SHA-1 highlights the role of
cryptographic hash functions in ensuring data reliability during transmission. Both algorithms
demonstrate that even a single bit change in the message leads to a completely different digest,
thereby making them effective for integrity verification. Performance analysis shows that MD-5
is faster and more efficient for smaller or larger files, while SHA-1, though slower, provides a
longer digest and comparatively stronger resistance against attacks. However, due to proven
vulnerabilities in both algorithms, they are no longer recommended for modern secure
applications. In practice, stronger alternatives such as SHA-256 or SHA-3 are adopted, but MD-5
and SHA-1 continue to hold academic importance for understanding the fundamentals of
hash-based message authentication and performance trade-offs.
