How many times can i compose a md5 function with itself?

Question

For studying purposes it would be usefull to find out how many times can i compose a md5 function with itself without getting the same value.

This is a paralell/complementary approach to the salt, because this way the value gets harder to crack using brute force.

Answer 1

Seemingly infinite. However MD5 has been shown to not be collision resistant so at some point you will have a duplicate.

The following Ruby code will cyclicly apply the MD5 hashing algorithm until a duplicate has been detected, at which point it will print the number of cycles required to reach the duplication point. The original string is randomly generated from alphabetical characters.

require 'set'
require 'digest'

keys = Set.new

o = [('a'..'z'), ('A'..'Z')].map { |i| i.to_a }.flatten
string = (0...10).map{ o[rand(o.length)] }.join
count = 0

while !keys.include?(string) do
  count += 1
  puts count
  keys << string
  string = Digest::MD5.digest(string)
end

puts "#{count}"

This continues to run past 15mil cycles... I will update once a duplicate has been found.

Update: due to the limited resources of my machine I had to halt the above script after 75,933,338 cycles without a collision (the set had allocated ~8 GB in memory)