Fog Creek Software
Discussion Board




Technical: MD5 Sums

I need to generate an MD5 sum for validation of a fairly large XML batch file. This sum will be included in an index file used to identify the information in the batch and will be referenced during a loading process to ensure the referential integrity of the system. I have the choice of using either Visual Basic 6 or Visual C++ for the hash process. I need to compare a provided hash to the file I have (I do not need to generate the original hash, it will be done in Java and provided by a third party).

What tools (preferably free or built in to the platform) can I use to do this in a simple and easy fashion? I'm looking for an SDK or something with a COM interface. Is anybody familiar with something of this nature? You would assume that it would be easy to find, but references to Microsoft's CryptoAPI seem to be DOA.

Dustin Alexander
Monday, August 25, 2003

Use .NET.

Seriously there are superb implementations (or hooks to cryptoapi implementations) of the various hashing (SHA1, MD5, etc), asymmetric and symmetric encryption routines in the .NET framework. Even if you don't fancy yourself a .NET programmer, writing a simple class to take a filename and return a hash is the height of triviality. You could compile it with the free SDK, create a COM Callable Wrapper on it, and there you go: Callable from your existing code.

Dennis Forbes
Monday, August 25, 2003

Not a possibility. I would use .NET (you are correct about its crypto packages) but the internal I/S department for the contract company has not yet made the switchover and won't be making it in the forseeable future. I/S acceptance of this project is very high on our priority list.

Dustin Alexander
Monday, August 25, 2003

Google for MD5 generator

Simon Lucy
Monday, August 25, 2003


Windows' Crypto API has support for MD5 and SHA1 hash algorithms. Search MSDN for "CryptCreateHash". The API is a little daunting, but very powerful. You can call Crypto API from VC++. There is probably a way to call it from VB, too.

There is no need to reinvent the wheel. Save yourself the time and trouble! Laziness is a programming virtue. :-)

runtime
Monday, August 25, 2003

This may help:
http://www.flippet.org/snippets.html
C++ code for md5 generation.

Ben
Monday, August 25, 2003

CAPICOM 2.0 will do what you want

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/security/security/hasheddata.asp

Just me (Sir to you)
Monday, August 25, 2003

Umm... since it's XML you might want to consider validation issues, etc.
Tools:
* openssl (www.openssl.org) has all the tools you could want to make MD5 sums, etc. On Windows, the above-mentioned OS libraries should also work without installing anything new.
* xmlsec (http://www.aleksey.com/xmlsec/) has all the tools needed to do proper 'XML' validation, which includes canonicalization, etc; this may be overkill for your needs.
* maybe the current or some future version of MSXML will have this sort of thing built in, I haven't looked.

mb
Monday, August 25, 2003

OpenSSL has MD5, and is a pleasure to use although painful to build, at least on Windows. Peter Gutmann's cryptlib is not free for commercial use, but is excellent, and has an OCX interface.

http://www.cs.auckland.ac.nz/~pgut001/cryptlib/

as
Monday, August 25, 2003

Here is an example C program that creates an MD-5 hash of a file just using the platform sdk.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/security/security/example_c_program__creating_an_md-5_hash_from_file_content.asp

Just me (Sir to you)
Tuesday, August 26, 2003

I recently completed a project involving MD5.

There are a number of MD5 codes kicking around on the Internet.  The ones I describe won't do XML or .NET or anything Microsofty, they just do MD5.

First, get RFC1321 from http://www.rfc-editor.org/
It has a sample implementation, which you are free to use provided that you give proper attribution, which may be difficult to do.

Second, Colin Plumb has developed a public-domain implementation. Google for "Colin Plumb MD5". This is the one I used; it has no license restrictions whatsoever and it works.

Aladdin Enterprises has developed an implementation that is "BSD licensed", but without the annoying "advertising clause".  Google for "Aladdin MD5".

Finally, OpenSSL has optimized assembly implementations of MD5.  I'm not sure of the license (probably GPL).

David Jones
Tuesday, August 26, 2003

You could try this C sample code from Microsoft as a starting point. Similar API/SDK code can be written in Visual Basic by declaring all the needed API functions, constants, and types (and as long as you remember, where appropriate, to pre-allocate strings before calling API functions and truncate the strings to the assigned length after the API call).

Example C Program: Creating an MD-5 Hash From File Content
http://msdn.microsoft.com/library/en-us/security/security/example_c_program__creating_an_md-5_hash_from_file_content.asp

The following example demonstrates using CryptoAPI to compute the MD-5 hash of the contents of a file. This example performs the computation on the contents of a file specified at run time.

Philip Dickerson
Tuesday, August 26, 2003

Microsoft's SDK documentation for cryptography (CryptoAPI), which includes generating hashes, starts at:
http://msdn.microsoft.com/library/en-us/security/security/cryptography_portal.asp

This portal leads you to the following sections (although you may need to read several parts of these sections before it becomes clearer which sequence of CryptoAPI functions you need to call and what parameter values you need to pass to some of the functions):

About Cryptography - Key cryptography concepts and a high-level view of Microsoft cryptography technologies.

Using Cryptography - Cryptography processes, procedures, and extended samples of C and Visual Basic programs using CryptoAPI functions and CAPICOM objects.

Cryptography Reference - Detailed descriptions of the Microsoft cryptography functions, interfaces, objects, structures, and other programming elements. Includes reference descriptions of the API for working with digital certificates.

Philip Dickerson
Tuesday, August 26, 2003

*  Recent Topics

*  Fog Creek Home