ip7z / 7zip

7-Zip
458 stars 57 forks source link

Were MD5 checksums removed intentionally? #1

Open sdasda7777 opened 6 months ago

sdasda7777 commented 6 months ago

Hi, I could swear 7-zip had option to create MD5 hash of a file through the CRC SHA, but now I can't seem to find a way to do it, only CRC or SHA. Am I misremembering? If not, would it be possible to bring this feature back?

ip7z commented 6 months ago

Maybe you used external 7-Zip plugins or some fork of 7-Zip? https://www.tc4shell.com/en/7zip/

inkydragon commented 6 months ago

Maybe you are looking for https://github.com/mcmilk/7-Zip-zstd

these hashes can be calculated: CRC32, CRC64, MD2, MD4, MD5, SHA1, SHA256, SHA384, SHA512, SHA3-256, SHA3-384, SHA3-512, XXH32, XXH64, BLAKE2sp, BLAKE3 (lowercase or uppercase)

SwimmeRM commented 2 months ago

""Even after doing a quick check into latest beta history.txt file it turns out that MD5 checksum support was indeed never added. And here's also the excerpt from it clarifying when and only which hashing types were added into 7-Zip. "... 9.25 alpha 2011-09-16 ...

Nevertheless, I can also very easily understand why until now any user might indeed have already seen "md5" mentioned by 7-zip itself. Just see below small excerpts from following 7-Zip main command line only commands :

But in all, my simple guess is also that such mention might just have been put there as a placeholder and probably only to preliminarily track a potential future adoption, even if then it was never really decided to implement it. P.S. And main reason for this is also understandable, since 1993 (source: Wikipedia) MD5 (RFC 1321) issues slowly began to come out, after 1996 many experts began to suggest switching to SHA-1, a (then) stronger replacement. In 2004, 2005, 2006, 2007 and 2008 even more issues came out up to CMU (Carnegie Mellon University) Software Engineering Institute, from CERT Coordination Center, release of an official "MD5 vulnerable to collision attacks" vulnerability note statement on 08/31/2008 suggesting "Do not use the MD5 algorithm" and also affirming "... it should be considered cryptographically broken and unsuitable for further use." and since then the number of MD5 related issues grew even more, until in 2011 informational RFC 6151 was approved to further update security considerations for MD5 and HMAC-MD5...