software hacking
Is it legal to crack MD5 hashes?
<p>I saw a website that involves programming problems. One problem asks to write a program that finds a string whose MD5 hash is given.</p>

<p>Is it criminal to crack the MD5 hash by finding those strings?</p>

<blockquote>
  <p>Is it criminal to find strings whose MD5 hash is known?</p>
</blockquote>

<p>No, unless the method or purpose involves gaining (or attempting to obtain) unauthorized access to others' computer systems or networks, or causing damage to them.</p>

<p>This applies regardless of whether you program some brute-force algorithm rather or query a public [online] database that stores reverse hashes.</p>

<p>The German criminal code has the <a href="https://www.gesetze-im-internet.de/englisch_stgb/englisch_stgb.html#p1880" rel="noreferrer">section 202c</a> "Acts preparatory to data espionage and phishing" which makes it illegal to produce (as well as trade, possess, supply, etc.) software intended for committing computer crimes. So the mere act of creating such a program can be a criminal act in Germany.</p>

<p>However, the constitutional court of Germany <a href="https://www.bundesverfassungsgericht.de/entscheidungen/rk20090518_2bvr223307.html" rel="noreferrer">ruled in 2009</a> that this law should only be applied if there is proof that the program was indeed intended for committing a crime (like cracking a password database and then using those passwords for unauthorized data access):</p>

<blockquote>
  <p>Eine weitere Einschränkung ergebe sich daraus, dass die Tathandlung
  zur Vorbereitung einer Computerstraftat erfolgen müsse. Entscheidend
  sei, dass der Täter eine eigene oder fremde Computerstraftat in
  Aussicht genommen habe. Das sei nicht der Fall, wenn das Programm
  beispielsweise zum Zwecke der Sicherheitsüberprüfung, zur Entwicklung
  von Sicherheitssoftware oder zu Ausbildungszwecken in der
  IT-Sicherheitsbranche hergestellt, erworben oder einem anderen
  überlassen werde.</p>
</blockquote>

<p>My translation:</p>

<blockquote>
  <p>Another limitation is that the act must be in preparation of a computer crime. It is essential that the perpetrator expected that an own or 3rd party crime would be committed. This is not the case if the program was created, obtained or provided for, for example, development of security software or educational use in the IT security industry.</p>
</blockquote>

<p>So one <em>might</em> get away with it if they can convince the judge that they only created and used the program for educational purposes.</p>

<p>It can't be criminal, because many people attempt to do this as a profession.</p>

<p>Anyone who tests the security of software systems or investigates vulnerabilities does so and gets a good salary for it. All encryption technologies that are now considered insecure have been tested in this way.</p>
