![]()
Paj's Home |
![]()
The MD4, MD5 and SHA-1 algorithms are all secure hash functions. They take a string as input, and produce a fixed size number - 128 bits for MD4 and MD5; 160 bits for SHA-1. This number is a hash of the input - a small change in the input results in a substantial change in the output number. The functions are thought to be secure in the sense that it requires an enormous amount of computing power and time to find a string which hashes to a chosen value. In others words, there's no way to decrypt a secure hash. The uses of secure hashes include digital signatures and challenge hash authentication. You can download free JavaScript implementations of all three algorithms:
The code works with most JavaScript implementations; Andrew Kepert has written a browser compatibility test with on-line results.
First you need to download the appropriate files for the hashes you want to use: md4.js, md5.js, or sha1.js. Save them in the same directory as your html file and insert these tags as required:
When you want to calculate a hash, use the following functions:
The functions return a string representation of the hash in lower-case hexadecimal. If you prefer it in upper case, do something like this:
The reason I wrote the MD5 implementation was to improve security on a login form on a website I was making, for a web space account with no SSL capability. You can use a secure hash function to avoid sending the password as clear text. This is more secure than using .htaccess file based access control. First the web server sends a random variable to the client. The client asks the user for the password, and makes the MD5 hash of the random variable and password. It sends this to the server. The server make the MD5 hash of the random variable and its stored password. If the two hashes match, then the user knew the correct password, and the server allows access. At no point was the password transmitted in the clear. An eavesdropped won't be able to do a replay attack as the server will then expect a different random variable. One caveat with using JavaScript cryptography is that it only protects you against passive eavesdropping. A malicious attacker who can modify network traffic can intercept the transmission of the JavaScript code and replace it with code that releases the password. There is no way round this, as the JavaScript is downloaded over an insecure link.
![]() This site in The Great JavaScripts Webring is owned by Paul Johnston. [ Previous | Next | Random Site | List Sites | Join ]
© Copyright 1998 - 2001 Paul Johnston Disclaimer Updated: 12 Mar 2001 Built: 8 Apr 2001 |