I saw a website that involves programming problems. One problem asks to write a program that finds a string whose MD5 hash is given.
Is it criminal to crack the MD5 hash by finding those strings?
Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.Sign up to join this community
Is it criminal to find strings whose MD5 hash is known?
No, unless the method or purpose involves gaining (or attempting to obtain) unauthorized access to others' computer systems or networks, or causing damage to them.
This applies regardless of whether you program some brute-force algorithm rather or query a public [online] database that stores reverse hashes.
The German criminal code has the section 202c "Acts preparatory to data espionage and phishing" which makes it illegal to produce (as well as trade, possess, supply, etc.) software intended for committing computer crimes. So the mere act of creating such a program can be a criminal act in Germany.
However, the constitutional court of Germany ruled in 2009 that this law should only be applied if there is proof that the program was indeed intended for committing a crime (like cracking a password database and then using those passwords for unauthorized data access):
Eine weitere Einschränkung ergebe sich daraus, dass die Tathandlung zur Vorbereitung einer Computerstraftat erfolgen müsse. Entscheidend sei, dass der Täter eine eigene oder fremde Computerstraftat in Aussicht genommen habe. Das sei nicht der Fall, wenn das Programm beispielsweise zum Zwecke der Sicherheitsüberprüfung, zur Entwicklung von Sicherheitssoftware oder zu Ausbildungszwecken in der IT-Sicherheitsbranche hergestellt, erworben oder einem anderen überlassen werde.
Another limitation is that the act must be in preparation of a computer crime. It is essential that the perpetrator expected that an own or 3rd party crime would be committed. This is not the case if the program was created, obtained or provided for, for example, development of security software or educational use in the IT security industry.
So one might get away with it if they can convince the judge that they only created and used the program for educational purposes.