MD5 Authentication

[Jeff Turpin]

Hello!

I've got a question here about a subject that I suppose I'm just not
understanding.

VisBasic.Net appears to have an object for computing the MD5 hash of a
string. It defines the C# code to compute this as:

'MD5 md5 = new MD5_CSP(); // this is one implementation
of the abstract class MD5
'md5.Write(data);
'md5.CloseStream();
'result = md5.Hash;

Trying to use the MD5_CSP object, I'm using the following code in VB:

Dim asciiget As Encoding = Encoding.Ascii
Dim MyHash As New MD5_CSP()
Dim MyByteArray() As Byte = asciiGet.GetBytes("abc")
Dim bMyResult() as Byte
Dim MyString as String

myhash.Write(MyByteArray)
bMyResult = MyHash.Hash

MyString = asciiget.GetString(byMyResult)

If I take a look at MyString at this point, by printing it to a TextBox, I
get mainly unreadable characters...

P <RO0V ?}(a r

If I change bMyResult into MyString using the following method...

MyString = ""
For X = 0 to bMyResult.GetUpperBound(0)
MyString = MyString & bMyResult(X)
Next

And then look at MyString, I get...

14418015260210791762141506312540225127114

Which either looks to me like a Decimal (Base 10) representation of the MD5
Hash, or.... (and this really might be stupid)... the ascii values for the
unreadable string above... ?

So if this is a Decimal rep. of my MD5 Hash, that's great and cool... except
that I thought an MD5 hash was supposed to spit out a HexiDec (base 16)
number... - Hashing "abc" should spit out: the following, according to RFC
1321:

900150983cd24fb0d6963f7d28e17f72

And... I've got noo clue how to convert a 44 digit number to a Hex number
without the computer shouting "Overflow, I'm gonna be broken now!" and then
promptly doing nothing else.

Can anyone clue me in on what's not jiving in this picture?
(Lord, I hope that all made sense!)

Thank you kindly!!!!!!

Jeff Turpin
thorf...@yahoo.com

[Jeff Turpin]

Correction of a typo, which is inline.

"Jeff Turpin" <thorf...@yahoo.com> wrote in message
news:ul2xKh2sAHA.1960@tkmsftngp04...

> Hello!
>
> I've got a question here about a subject that I suppose I'm just not
> understanding.
>
> VisBasic.Net appears to have an object for computing the MD5 hash of a
> string. It defines the C# code to compute this as:
>
> 'MD5 md5 = new MD5_CSP(); // this is one
implementation
> of the abstract class MD5
> 'md5.Write(data);
> 'md5.CloseStream();
> 'result = md5.Hash;
>
> Trying to use the MD5_CSP object, I'm using the following code in VB:
>
> Dim asciiget As Encoding = Encoding.Ascii
> Dim MyHash As New MD5_CSP()
> Dim MyByteArray() As Byte = asciiGet.GetBytes("abc")
> Dim bMyResult() as Byte
> Dim MyString as String
>
> myhash.Write(MyByteArray)
> bMyResult = MyHash.Hash
>
> MyString = asciiget.GetString(byMyResult)

------------------------------------------------^ - It's just plain
bMyResult

[Michael Abraham]

The decimal string does contain the correct result. The second conversion
to MyString converted each byte to a string representation of the decimal
value of the byte, with string length varying from 1 to 3, depending on the
number of decimal digits required. I have split up the decimal string so
that it corresponds to the hex string. You can see that each chunk of the
decimal string has the same value as the corresponding byte in the hex
string. For example 144 = 0x90, 1 = 0x1, 80 = 0x50, 152 = 0x98, ..., 225 =
0xe1, 127 = 0x7f, 114 = 0x72

144 1 80 152 60 210 79 176 214 150 63 125 40 225 127
114

90 01 50 98 3c d2 4f b0 d6 96 3f 7d 28 e1 7f
72

HTH,

Mike Abraham

"Jeff Turpin" <thorf...@yahoo.com> wrote in message

news:O9Km1D3sAHA.2248@tkmsftngp05...

[Jeremy Gray]

On Fri, 23 Mar 2001 00:11:09 -0800, "Jeff Turpin"
<thorf...@yahoo.com> wrote:

>> And then look at MyString, I get...
>>
>> 14418015260210791762141506312540225127114
>>
>> Which either looks to me like a Decimal (Base 10) representation of the
>MD5
>> Hash, or.... (and this really might be stupid)... the ascii values for the
>> unreadable string above... ?

Without really digging into the resulting string, it's more likely
that it is the byte values of the array, each written out in base 10,
but without leading zeros to keep each byte at three characters a
piece.

>> So if this is a Decimal rep. of my MD5 Hash, that's great and cool...
>except
>> that I thought an MD5 hash was supposed to spit out a HexiDec (base 16)
>> number... - Hashing "abc" should spit out: the following, according to RFC
>> 1321:
>>
>> 900150983cd24fb0d6963f7d28e17f72

I'm not sure about the RFC itself, but as far as I know, MD5 itself
results in a 128 bit number which could be represented in many ways.

I've been doing a lot of work (back in VB6 land) with MD5
implementations recently generating hashes for comparisons, and have
found byte array -outputting MD5 routines to be much more useful than
ones that only output hex-encoded strings.

At least you can take a 16 byte array and easily use it however you
want... Leave it as is for application use, encode it as base64 or
encode it as a hex string. If the MD5 implementation _only_ outputs
hex-encoded strings, you're left with a lot of work if you want it
back in an array or if you want it base64'ed.

Keep this in mind, too... A 128 bit MD5 hash encoded as a hex
(unicode) string gets (at least) _quadrupled_ in size. Before anyone
asks - 2 bytes for one byte to encode as hex characters, then two
bytes per character (or more, depending on character set). :-)

If I were in your position, I'd do some searching in the base class
libraries for some code which can turn a byte array into a hex-encoded
string. Given that the code you posted returns an array, and that most
people do represent MD5 hashes as strings of hex characters, I'll bet
there's a class in there just waiting to do your bidding.

If you don't find one, however, it's easy to whip up a Byte array ->
hex string conversion routine. I have some rough VB6 source for this
purpose. Just lemme know if you need it and I'll post it.

Jeremy

[Jeremy Gray]

On Fri, 23 Mar 2001 08:52:37 -0800, Jeremy Gray
<jer...@homeREMOVESPAM.com> wrote:

>Keep this in mind, too... A 128 bit MD5 hash encoded as a hex
>(unicode) string gets (at least) _quadrupled_ in size. Before anyone
>asks - 2 bytes for one byte to encode as hex characters, then two
>bytes per character (or more, depending on character set). :-)

Also, before anyone asks :-) the above assumes a unicode Win32
platform (eg: WinNT, Win2K, etc., but not the Win9x series).

Jeremy

[Jeff Turpin]

Wow. The rain must be gone, because I can see clearly now.

Thank you - that makes so much sense, and you're officially "awesome" in my
eyes.

Jeff Turpin
thorf...@yahoo.com

"Michael Abraham" <mabr...@monitor.com> wrote in message
news:#$MDcZ7sAHA.1456@tkmsftngp04...