Md5

Deborah J Canales

Lab #1

MD5 Checksum Utility

IS 3523

The goal of this paper is to define and explore the MD5 checksum utility. It is also my goal to discuss how to use MD5 checksums to support Incident Response. Enclosed with this paper will be copies of checksums computed on my machine as I did the lab.

First off, I will start with talking a little about MD5 and where it stems from. In relation to cryptography, MD5 stands for Message Digest Algorithm 5. It is also known as RFC 1321. Cryptography is the basis for secure communications .It is by definition, a science of writing or reading coded message. MD5 falls under the category of Hash Functions. A hash function takes a message of arbitrary length and spits out a fixed length code. The output is called the message digest or hash. One way hash functions are used to provide a "fingerprint" of a message or file. The hash fingerprint is supposed to be unique and because of this can prove the authenticity of the message.

MD5 was developed by a professor named Ronald Rivest of the prestigious MIT. He created the algorithm to replace an earlier hash function which was MD4. The main job of this digest is to provide some sort of assurance that a transferred file has indeed arrived intact. MD5 along with another hash function called SHA (Secure Hash Algorithm), are the most widely used in current product implementations.

The main MD5 message digest is represented as 16-byte (128-bits) Hexadecimal number ( written as 32 characters using the digits 0-9 and A-F or a-f ). This value can be found all over the internet. The checksum is a type of redundancy check that will verify the data in a number of ways. MD5 allows a string of unique letters and numbers to stand for data. MD5 can be used across all platforms making it universal. You can use it with windows, or any other operating system that you wish. I myself used it on Windows XP and it worked flawlessly.

While MD5 checksums are used mostly for data verification and for passwords, it is important to note that applications that decompile MD5 sums are widely available on the internet among other places. One should use caution when storing a password with it. The reason for this is because in addition to de-compilers available on the internet, there are also databases of MD5 reverse lookup info. This info allows the hash to be decrypted. This is why it is better to use a SALT when you are hashing your password.

However, MD5 is very efficient in data protection and recovery and is used with confidence in this area. .

In this section of the paper I will discuss what exactly incident response, and how MD5 plays a role in it. By definition, Incident Response is a response to an occurrence that deals with information security. When a breach of security happens, incident response is the actions of the workers against the security breach. There are many reasons that security breaches happen in a company. Some are internal breaches, inside jobs by employees, while some are outside works.

The main goal of incident response is to take care of the situation in a fashion that minimizes down time, minimizes cost of recovery and minimizes damage as well. Two of the many goals of incident response are: to prevent a maniac response to an incident and to establish proper procedures for handling of the evidence in case an incident does happen. Of course, the best way to make sure that an incident