What is MD5?
MD5 (“Message Digest [algorithm] #5”) is the most common data integrity check standard (a.k.a. “hash”) used throughout the world today. MD5 codes are 128-bit numbers and are usually represented in hexadecimal format (e.g., “9508bd6aab48eedec9845415bedfd3ce”).
MD5 was created in 1991 as a replacement for MD4 and its popularity exploded at the same time use of the Internet did as well. MD5’s use carried over into file transfer software and its use remains common today (e.g., FTP’s unofficial “XMD5” command).
Although MD5 is considered a “cryptographic quality” integrity check (as specified in RFC 1321), it is not considered a secure hash today because it is possible for an attacker to create bad data that bears the same MD5 code as a set of good data. For this reason, NIST has now banned the use of MD5 in key U.S. Federal Government applications.
BEST PRACTICE: Modern file transfer deployments should use FIPS validated SHA-1 or SHA-2 implementations for integrity checks instead of MD5. However, FTP software that supports the XMD5 command can be useful to provide backwards compatibility during migration to stronger hashes.