How to test cryptography methods

Question

I recently have a problem with a crypto library which produces bad md5 output. Instead of 32 digits it returns 30.

As we don't use unit test, this problem was quite a headache to solve... because we assumed that md5 string was correct and look for bugs in other places.

That make me realize of the real value of unit tests (unit test first, tdd later).

But I'm not sure how to test cryptographic methods well enough. How do you get proper expected values?

EDIT: Thanks for the answers, I think I didn't explain it enough.

The problem was with a third party tool wich produces bad md5 output. Then, how do you get that assert value? I know it mustn't change, just I don't get how to obtain it from a reliable source.

Answer 1

Known correct data for cryptographic algorithms is usually called test vectors. So google "MD5 test vectors" to get a ton of good input data for your tests.

The most authoritative resource for test vectors is of course the document defining the algorithm. Most standards documents will include a set of test vectors. For instance, RFC 1321 contains the following set of test data:

MD5 ("") = d41d8cd98f00b204e9800998ecf8427e
MD5 ("a") = 0cc175b9c0f1b6a831c399e269772661
MD5 ("abc") = 900150983cd24fb0d6963f7d28e17f72
MD5 ("message digest") = f96b697d7cb7938d525a2f31aaf161d0
MD5 ("abcdefghijklmnopqrstuvwxyz") = c3fcd3d76192e4007dfb496cca67e13b
MD5 ("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789")
  = d174ab98d277d9f5a5611c2c9f419d9f
MD5 ("12345678901234567890123456789012345678901234567890123456789012345678901234567890") 
  = 57edf4a22be3c955ac49da2e2107b67a