MD2
MD2
The 1989 original, its table drawn from π.
- Digest
- 128-bit · 16 bytes
- HMAC
- takes a key
- Security
- BROKEN: preimages in 2^73 and collisions in 2^63.3 (RFC 6149)
- Family
- 4 in MD
Sample
- hex
- d9cce882ee690a5c1ce70beff3a78c77
- base64
- 2czogu5pClwc5wvv86eMdw==
Options
Access
- Create
create("md2") - CLI
hashes md2 'hello world' - Tryplayground with the sample above
- Kinmd5, md4, ntlm
Before MD4 there was this. Rivest built MD2 in 1989 for 8-bit machines, so it works one byte at a time. Every 16-byte block takes eighteen passes over a 48-byte state. A checksum of all the blocks rides along and gets hashed last.
Where does its table of 256 bytes come from? The digits of π. RFC 1319 just prints the result. This package draws it from π itself, the first time you ask. The shuffle eats 722 digits and lands exactly on the RFC's table. Nothing up the sleeve, and you don't have to take anyone's word for it.
create("md2").hash("abc").digest; // "da853b0d3f88d99b30283a69e6ded6bb"
create("md2").hash("").digest; // "8350e5a3e24c153df2275c9f80692773"
Safe? No. A preimage costs 2^73 instead of 2^128. RFC 6149 moved MD2 to Historic in 2011. It's slow as well, about twenty times slower than MD4 here. Byte by byte has a price.
So why keep it? PKCS #1 still lists md2WithRSAEncryption, and old certificates carry it. OpenSSL has left MD2 out by default since 1.0.0, so Node won't compute it at all. HMAC works over its 16-byte blocks, though RFC 6149 warns it can leak bits of the key. Check old data with it. Build nothing new.