I saw a website that involves programming problems. One problem asks to write a program that finds a string whose MD5 hash is given.
Is it criminal to crack the MD5 hash by finding those strings?
11
-
35What counts as "criminal" will vary widely by jurisdiction - without specifying that, answers will not be relevant.– RiotCommented Feb 25, 2020 at 0:32
-
8Note that finding a string that would generate a given hash value is how Bitcoin works. In cryptocurrencies it is called mining– slebetmanCommented Feb 25, 2020 at 7:59
-
93Using MD5 for anything other than checksums is the real crime.– Freek NortierCommented Feb 25, 2020 at 8:22
-
11If a tool that calculates a lot of MD5 hashes is illegal, then a tool that calculates one hash must be illegal, because anyone could simply use that tool multiple times.– MechMK1Commented Feb 25, 2020 at 12:12
-
24@MechMK1: That's a science-based answer, not a legal answer. Literally, the law doesn't work like that. Asking someone out on a date is fine; doing that a hundred times is stalking.– MSaltersCommented Feb 25, 2020 at 13:08
|
Show 6 more comments
3 Answers
Is it criminal to find strings whose MD5 hash is known?
No, unless the method or purpose involves gaining (or attempting to obtain) unauthorized access to others' computer systems or networks, or causing damage to them.
This applies regardless of whether you program some brute-force algorithm rather or query a public [online] database that stores reverse hashes.
-
1@MikeScott "shouldn’t be answered without such specification". Several issues of law undergo a very similar development in many jurisdictions. The OP's question touches on one such issue. Modern societies are increasingly interrelated, and the ensuing awareness of how issues are legislated elsewhere gives stronger/more arguments for enacting similar provisions than if societies lived in isolation. As for where reverse hashing "might" be a capital offence, one ought to assess first whether serious technology would be even feasible in a hypothetical jurisdiction that holds such punitive views. Commented Feb 27, 2020 at 11:13
The German criminal code has the section 202c "Acts preparatory to data espionage and phishing" which makes it illegal to produce (as well as trade, possess, supply, etc.) software intended for committing computer crimes. So the mere act of creating such a program can be a criminal act in Germany.
However, the constitutional court of Germany ruled in 2009 that this law should only be applied if there is proof that the program was indeed intended for committing a crime (like cracking a password database and then using those passwords for unauthorized data access):
Eine weitere Einschränkung ergebe sich daraus, dass die Tathandlung zur Vorbereitung einer Computerstraftat erfolgen müsse. Entscheidend sei, dass der Täter eine eigene oder fremde Computerstraftat in Aussicht genommen habe. Das sei nicht der Fall, wenn das Programm beispielsweise zum Zwecke der Sicherheitsüberprüfung, zur Entwicklung von Sicherheitssoftware oder zu Ausbildungszwecken in der IT-Sicherheitsbranche hergestellt, erworben oder einem anderen überlassen werde.
My translation:
Another limitation is that the act must be in preparation of a computer crime. It is essential that the perpetrator expected that an own or 3rd party crime would be committed. This is not the case if the program was created, obtained or provided for, for example, development of security software or educational use in the IT security industry.
So one might get away with it if they can convince the judge that they only created and used the program for educational purposes.
-
17That German law (before jurisprudence fine-tuned it) was insane. By the letter of that law a lot of network tools that are normal parts of any modern OS (like the ping command) were ciminalized, because they could potentially be used to attack (e.g. ping of death). In principle everybody with a computer or a smartphone was in violation of that law. Only later (in 2009) the intent of the user of such software was included. (Which makes a lot more sense: A hammer can be used to murder someone. That doesn't make all carpenters criminals.)– TonnyCommented Feb 25, 2020 at 14:41
-
3Reminds me of furtum usus: Essentially borrowing something without permission, but with the intent to return it. Furtum usus is not punishable in Germany but the problem is usually to prove that you always intended to return it. Courts typically refuse that argument from thieves. I did that once when my library card was expired and I took the book anyway because I needed it for the CS exam. (I graduated.) The librarian had my personal data and I said "see you in a few hours". It's not theft. Commented Feb 25, 2020 at 15:07
-
18The english translation of that law suggests to me that you don't need to convince the judge that the you were only creating and using the program for educational purposes. Isn't it closer to saying that the prosecutors have to convince the judge that you were using it for a crime? Those are quite different things, and by the sounds of it you mixed up the burden of proof, unless it was just an issue with translation.– JMacCommented Feb 25, 2020 at 18:58
-
2@ChristopherCreutzig As I work in IT for a partially German company I had reason back in the day to go over that law together with our legal team. We all concluded that the intent of the law was obvious, but the wording was vague enough that it didn't actually say so. And thus could be interpreted by a prosecutor in the worst possible way. And that really happened: It was often used as an extra charge laid on just about anyone accused of a computer-related crime. That stopped in 2009 when such a case finally made it up to the Constitutional Court and the Court clarified this aspect.– TonnyCommented Feb 27, 2020 at 10:32
-
1"software intended for committing computer crimes" if, as the history cited suggests, intent in Germany means anything close to what it means in English speaking countries with common law roots then the mere act of creating such a program could never be a crime. Not that this precludes expensive and ruinous (for the accused) attempts to prove otherwise. Commented Mar 6, 2020 at 22:53
It can't be criminal, because many people attempt to do this as a profession.
Anyone who tests the security of software systems or investigates vulnerabilities does so and gets a good salary for it. All encryption technologies that are now considered insecure have been tested in this way.
-
1The original question was: "Is it illegal to write code that decrypts an encrypted string and publish the code? And my answer is, it can't be illegal. Every security researcher in the world is trying to check existing systems, even those based on encryption, for weaknesses and of course they develop methods to circumvent this encryption and publish the results.– dm76752Commented Mar 7, 2020 at 10:53
-
I do not disagree, but let us test your arguments on another act: To sell or distribute drugs. - It can't be criminal, because many people attempt to do this as a profession. - Anyone who has such a profession does so and gets a good salary for it. - Many big corporations have been funded this way.– SuperoleCommented Nov 3, 2021 at 11:02
-
Each algorithm is only used as long as it is safe. And whether it is still safe must be checked again and again. The verification and publication of the results cannot be prohibited, otherwise many would be liable to prosecution. If someone writes and sells decryption software, complicity in the buyer's deeds may come into play. So it depends on the recipient. If I sell it to the police, they will not call the prosecutor afterwards. If I sell it to criminals (knowingly), I have a problem. But the question was: Publication.– dm76752Commented Nov 4, 2021 at 16:06