Authenticating Communications Using Digital Signatures - Implementing SSL/TLS Using Cryptography and PKI - page 169

// Special handling for blocks between 56 and 64 bytes
// (not enough room for the 8 bytes of length, but also
// not enough to fill up a block)
if ( len < MD5_BLOCK_SIZE )
{
memset( padded_block, 0, sizeof( padded_block ) );
memcpy( padded_block, input, len );
padded_block[ len ] = 0x80;
md5_block_operate( padded_block, hash );

input += len;
len = -1;
}

5. Append the length, the padding bits and a trailing “1” bit — if it hasn't
already been added — and operate on the fi nal block. There will be
448 l . These are l bits of padding, where l is the length of the input in

bits. Note that this always happens, even if the input is 1 bit long.

// There's always at least one padded block at the end, which includes
// the length of the message
memset( padded_block, 0, sizeof( padded_block ) );
if ( len >= 0 )
{
memcpy( padded_block, input, len );
padded_block[ len ] = 0x80;
}

// Only append the length for the very last block
// Technically, this allows for 64 bits of length, but since we can only
// process 32 bits worth, we leave the upper four bytes empty
// This is sort of a odd concept of “little endian”...
padded_block[MD5_BLOCK_SIZE - 5]=(length_in_bits & 0xFF000000)>>24;
padded_block[MD5_BLOCK_SIZE - 6]=(length_in_bits & 0x00FF0000)>>16;
padded_block[MD5_BLOCK_SIZE - 7]=(length_in_bits & 0x0000FF00)>>8;
padded_block[MD5_BLOCK_SIZE - 8]=(length_in_bits & 0x000000FF);

md5_block_operate( padded_block, hash );

6. Because input greater than 2 32 isn't allowed in this implementation, leave
the last four bytes empty (0) in all cases.

And you now have a 128-bit output that is essentially unique to the input.

MD5 Vulnerabilities

If you gathered 366 people in a room, there's a 100 percent chance that two of
them will share the same birthday. There are only 365 birthdays to go around,
so with 366 people at least two must have the same birthday (367 if you want
to count Feb. 29 and Mar. 1 as two distinct birthdays). This is clear. Here's a