I saw a website that involves programming problems. One problem asks to write a program that finds a string whose MD5 hash is given.

Is it criminal to crack the MD5 hash by finding those strings?

  • 34
    What counts as "criminal" will vary widely by jurisdiction - without specifying that, answers will not be relevant. – Riot Feb 25 '20 at 0:32
  • 8
    Note that finding a string that would generate a given hash value is how Bitcoin works. In cryptocurrencies it is called mining – slebetman Feb 25 '20 at 7:59
  • 90
    Using MD5 for anything other than checksums is the real crime. – Freek Nortier Feb 25 '20 at 8:22
  • 11
    If a tool that calculates a lot of MD5 hashes is illegal, then a tool that calculates one hash must be illegal, because anyone could simply use that tool multiple times. – MechMK1 Feb 25 '20 at 12:12
  • 24
    @MechMK1: That's a science-based answer, not a legal answer. Literally, the law doesn't work like that. Asking someone out on a date is fine; doing that a hundred times is stalking. – MSalters Feb 25 '20 at 13:08

Is it criminal to find strings whose MD5 hash is known?

No, unless the method or purpose involves gaining (or attempting to obtain) unauthorized access to others' computer systems or networks, or causing damage to them.

This applies regardless of whether you program some brute-force algorithm rather or query a public [online] database that stores reverse hashes.

  • 1
    @MikeScott "shouldn’t be answered without such specification". Several issues of law undergo a very similar development in many jurisdictions. The OP's question touches on one such issue. Modern societies are increasingly interrelated, and the ensuing awareness of how issues are legislated elsewhere gives stronger/more arguments for enacting similar provisions than if societies lived in isolation. As for where reverse hashing "might" be a capital offence, one ought to assess first whether serious technology would be even feasible in a hypothetical jurisdiction that holds such punitive views. – Iñaki Viggers Feb 27 '20 at 11:13

The German criminal code has the section 202c "Acts preparatory to data espionage and phishing" which makes it illegal to produce (as well as trade, possess, supply, etc.) software intended for committing computer crimes. So the mere act of creating such a program can be a criminal act in Germany.

However, the constitutional court of Germany ruled in 2009 that this law should only be applied if there is proof that the program was indeed intended for committing a crime (like cracking a password database and then using those passwords for unauthorized data access):

Eine weitere Einschränkung ergebe sich daraus, dass die Tathandlung zur Vorbereitung einer Computerstraftat erfolgen müsse. Entscheidend sei, dass der Täter eine eigene oder fremde Computerstraftat in Aussicht genommen habe. Das sei nicht der Fall, wenn das Programm beispielsweise zum Zwecke der Sicherheitsüberprüfung, zur Entwicklung von Sicherheitssoftware oder zu Ausbildungszwecken in der IT-Sicherheitsbranche hergestellt, erworben oder einem anderen überlassen werde.

My translation:

Another limitation is that the act must be in preparation of a computer crime. It is essential that the perpetrator expected that an own or 3rd party crime would be committed. This is not the case if the program was created, obtained or provided for, for example, development of security software or educational use in the IT security industry.

So one might get away with it if they can convince the judge that they only created and used the program for educational purposes.

  • 16
    That German law (before jurisprudence fine-tuned it) was insane. By the letter of that law a lot of network tools that are normal parts of any modern OS (like the ping command) were ciminalized, because they could potentially be used to attack (e.g. ping of death). In principle everybody with a computer or a smartphone was in violation of that law. Only later (in 2009) the intent of the user of such software was included. (Which makes a lot more sense: A hammer can be used to murder someone. That doesn't make all carpenters criminals.) – Tonny Feb 25 '20 at 14:41
  • 3
    Reminds me of furtum usus: Essentially borrowing something without permission, but with the intent to return it. Furtum usus is not punishable in Germany but the problem is usually to prove that you always intended to return it. Courts typically refuse that argument from thieves. I did that once when my library card was expired and I took the book anyway because I needed it for the CS exam. (I graduated.) The librarian had my personal data and I said "see you in a few hours". It's not theft. – Peter - Reinstate Monica Feb 25 '20 at 15:07
  • 17
    The english translation of that law suggests to me that you don't need to convince the judge that the you were only creating and using the program for educational purposes. Isn't it closer to saying that the prosecutors have to convince the judge that you were using it for a crime? Those are quite different things, and by the sounds of it you mixed up the burden of proof, unless it was just an issue with translation. – JMac Feb 25 '20 at 18:58
  • 2
    @ChristopherCreutzig As I work in IT for a partially German company I had reason back in the day to go over that law together with our legal team. We all concluded that the intent of the law was obvious, but the wording was vague enough that it didn't actually say so. And thus could be interpreted by a prosecutor in the worst possible way. And that really happened: It was often used as an extra charge laid on just about anyone accused of a computer-related crime. That stopped in 2009 when such a case finally made it up to the Constitutional Court and the Court clarified this aspect. – Tonny Feb 27 '20 at 10:32
  • 1
    "software intended for committing computer crimes" if, as the history cited suggests, intent in Germany means anything close to what it means in English speaking countries with common law roots then the mere act of creating such a program could never be a crime. Not that this precludes expensive and ruinous (for the accused) attempts to prove otherwise. – Trevor Reid Mar 6 '20 at 22:53

It can't be criminal, because many people attempt to do this as a profession.

Anyone who tests the security of software systems or investigates vulnerabilities does so and gets a good salary for it. All encryption technologies that are now considered insecure have been tested in this way.

  • 1
    The original question was: "Is it illegal to write code that decrypts an encrypted string and publish the code? And my answer is, it can't be illegal. Every security researcher in the world is trying to check existing systems, even those based on encryption, for weaknesses and of course they develop methods to circumvent this encryption and publish the results. – dm76752 Mar 7 '20 at 10:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.