RFC 1810
Report on MD5 Performance
Report on MD5 Performance 🎀
Okay bestie, this is RFC 1810, and it's literally a report on how fast MD5 runs 💅. It was written by J. Touch from ISI, and it came out in June 1995 as part of the Network Working Group 🌸. It's marked Informational, so it's sharing info, not a standard. The header doesn't list anything it obsoletes or updates, so it's a solo act 🦋.
Status of this Memo 📜
This memo is giving info to the Internet community 💖. It does not specify an Internet standard of any kind, and distribution of this memo is unlimited ✨.
Abstract 💜
Okay so MD5 is an authentication algorithm, and it got proposed as the default authentication option in IPv6 🫶. When it's turned on, MD5 runs over the entire data packet, header included 🎀. This RFC looks at how fast MD5 can be done in software and in hardware, and whether that's fast enough for the IP bandwidth we already have 🌈.
Spoiler: MD5 can hit 256 Mbps in existing hardware and 87 Mbps in software 💀. That can't keep up with current IP rates, like 100 Mbps TCP and 130 Mbps UDP over ATM 😭. If MD5 can't handle the bandwidth we already have using the tech we already have, it's not going to scale as networks get faster ✨.
So this RFC is here to alert the IP community about MD5's performance limits, and to suggest that alternatives be considered for high speed IP implementations 👑.
Introduction 🦋
MD5 is an authentication algorithm, and it's been proposed as one authentication option in IPv6 [1]. RFC 1321 describes the MD5 algorithm and gives a reference implementation [3]. When it's enabled, MD5 runs over the entire data packet, header included (with dummy values for the volatile fields) 🧚. This RFC is looking at how fast MD5 can be implemented in software and hardware, and whether it keeps up with the IP bandwidth that's available right now 💅.
This RFC is looking at checksumming and security at high speed in IPv6 more generally 🌸. IPv6 has no header checksum (IPv4 has one [5]), but it proposes an authentication digest over the entire body of the packet, with the header included and its volatile fields zeroed [1] 🎀. This RFC zooms in on how well that authentication mechanism performs 🔥.
Measurements 🔥
The performance of MD5 was measured 📊. The code was an optimized version of the MD5 reference implementation from the RFC [3], and it's available for anonymous FTP [7]. Here are the results of the performance test "md5 -t", modified to prohibit on-chip caching of the data block 🍓:
87 Mbps DEC Alpha (190 Mhz)
33 Mbps HP 9000/720
48 Mbps IBM RS/6000 7006 (PPC 601 @80 Mhz)
31 Mbps Intel i486/66 NetBSD
44 Mbps Intel Pentium/90 NeXTStep
52 Mbps SGI/IP-20 IRIX 5.2
37 Mbps Sun SPARC-10/51, SPARC-20/50 SunOS 4.1.3
57 Mbps Sun SPARC-20/71 SunOS 4.1.3Bestie, these rates do not keep up with currently available IP bandwidth 😭, like 100 Mbps TCP and 130 Mbps UDP over a Fore SBA-200 ATM host interface in a Sun SPARC-20/71 💀.
Values as high as 100 Mbps have been reported for the DEC Alpha (190 Mhz) 🌈. Those values reflect on-chip caching of the data 🧠. It's not clear yet whether in-memory, off-chip cache, or on-chip cache performance measures are more relevant to IP performance 🤔.
Analysis of the MD5 Algorithm 🧮
The MD5 algorithm is a block-chained hashing algorithm 🔗. The first block gets hashed with an initial seed, and that gives you a hash. The hash is summed with the seed, and that result becomes the seed for the next block. When the last block is computed, its "next-seed" value becomes the hash for the entire stream 🫶. So the seed for each block depends on both the hash and the seed of the block before it 💅. Because of that, blocks can't be hashed in parallel 🙈.
Each 16-word (64-byte) block gets hashed through 64 basic steps, using a 4-word intermediate hash, and collapsing the intermediate hash at the end ✨. The 64 steps are 16 groups of 4 steps, with one step per intermediate hash word 🎀. This RFC uses the following notation (as from RFC-1321 [3]) 📝:
A,B,C,D intermediate hash words
X[i] input data block
T[i] sine table lookup
<< i rotate i bits
F logical functions of 3 argsThe subscripts to X, I, and << are fixed for each step, so they're left out here. There are four different logical functions, also left out. Each 4-step group looks like this 🧚:
A = B + ((A + F(B,C,D) + X[i] + T[i]) << i)
D = A + ((D + F(A,B,C) + X[i] + T[i]) << i)
C = D + ((C + F(D,A,B) + X[i] + T[i]) << i)
B = C + ((B + F(C,D,A) + X[i] + T[i]) << i)This has the general form shown below. Because the function 'f' is so complex, these equations can't be transformed into a less serial set 😭.
A = f(D); B = f(A); C = f(B); D = f(C)Each step is made of two table lookups, one rotation, a 3-component logical operation, and 4 additions 🧮. The best parallelization possible leaves F(x,y,z) to the last step, waiting as long as possible for the result from the previous step ⏳. The resulting trees are shown below 🌳.
(t0) B* C C D X T
| | | | | |
| | | | | |
\/ \/ \ /
t1 op op A + X T
\ / \ / | |
\ / \ / | |
\/ \/ \ /
t2 op + (t0) B* C C D A +
\ / | | | | \ /
\ / \ | | / \ /
\ / \\// \/
t3 + t1 op +
| \ /
| \ /
| \ /
t4 << B* t2 + B*
\ / \ /
\ / << /
\ / \ /
t5 + t3 +
| |
| |
| |
A** A**
Binary operation tree Optimized hardware treeThis diagram assumes that each operation takes one unit of time 🕐. The tree marks the items that depend on the previous step as B*, and the item that the next step depends on as A**. Sequences in the binary operation tree can't be overlapped, but the optimized hardware tree can be overlapped (by one time step) 🙌.
There are 4 steps processed per word of input, ignoring inter-block processing 🔢. The speed of the whole algorithm depends on how fast we can process these 4 steps, compared with the bandwidth of one word of input being processed 💨.
The binary tree takes 5 time units per step of the algorithm, and allows at best 3-way parallelism (at time t1) 🧩. In software, that means it takes 5 * 4 = 20 instructions per word of input 💻. A computer capable of M MIPS can support a data bandwidth of M/20 * 32 Mbps, i.e., bits per second equal to 1.6x its MIPS rate 🤯. So a 100 MIPS machine can support a 160 Mbps stream 🎉.
Parallel software rate in Mbps = 1.6 * MIPS rateThis assumes that register reads and writes are overlapped with computation entirely 🔄. Without any parallelism, there are 8 operations per step and 4 steps per word, so 32 operations per word. That means the data rate in Mbps would be identical to the MIPS rate 😌:
Serial software rate in Mbps = MIPS rateNext, here are predictions using SpecInt92 numbers as MIPS estimators, compared with measured rates [2] 📈:
Spec- Predicted MD5
Int92 Upper-Bound Measured Machine
------------------------------------------------------------
122 122-195 87 Mbps DEC Alpha (190 Mhz)
48 48- 77 33 Mbps HP 9000/720
88 88-141 48 Mbps IBM RS/6000 7006 (PPC 601 @80 Mhz)
32 32- 51 31 Mbps Intel i486/33 NetBSD
90 90-144 44 Mbps Intel Pentium/90 NeXTStep
90 90-144 52 Mbps SGI/IP-20 IRIX 5.2
65 65-104 37 Mbps Sun SPARC-10/51 SunOS 4.1.3
126 126-202 57 Mbps Sun SPARC-20/71 SunOS 4.1.3The hardware rate takes 3 time units per step, so 3 * 4 = 12 time units per word of input 🔧. Hardware that can do an operation (e.g., 32-bit addition) in N nanoseconds can support a data bandwidth of 32/12/N bps, i.e., 2/3N bps 🧠. In Mbps, that's:
Hardware rate in Mbps = 8/3N * 1,000For CMOS, an operation (32-bit addition, including register retrieval and storage) costs about 5.2 ns (2.6 ns per add, 2 ns for latching) [6] ⚡. There are 6 clocks through the most highly-parallelized implementation, which works out to 31.2 ns per 32-bit word, or 256 Mbps [6] 🥹. That won't keep pace with existing hardware, which is capable of link speeds in excess of 622 Mbps (ATM) 😬.
By comparison, IPv4 uses the Internet Checksum [5]. This checksum can be performed in 32-bit-wide units in excess of 1 Gbps in an existing, low-cost PLD. The checksum can also be parallelized by computing partial sums and reducing the result 💖.
Security Considerations ✨
okay bestie, this whole document is about giving IPv6 real security 🛡️💖 MD5 is the proposed default optional authentication mechanism for IPv6 traffic. The actual concern here is that security stuff like MD5, which can't keep up with high bandwidth on the hardware we've got, will wreck its own deployment and, ultimately, the security of the systems it's supposed to protect 😭
The IPv6 requirements doc says IPv6 implementations should not compromise performance compared to IPv4. That's presumably even with IPv6's extra functionality 💅 "Required optional" pieces of IPv6 should be held to that same standard. MD5 compromises performance, so using it as the required default option in IPv6 should be reconsidered 🙈
Using MD5 as the default for the required authentication option may compromise security in high-bandwidth systems, because turning the option on causes performance degradation, and that defeats the whole reason it's included as an IPv6 option 💀 As a result, the authentication option may be disabled entirely.
It's important for authentication in high-performance systems that an alternative mechanism be available in IPv6 from the outset 🦋 This may require specifying multiple "required" authentication algorithms: one that's slower but believed strong, and one that's faster but may inspire somewhat less confidence 🎀
Conclusions 👑
the tea ☕ MD5 cannot be implemented in existing technology at rates in excess of 256 Mbps in hardware, or 86 Mbps in software 💀 And MD5 is a proposed authentication option in IPv6, a protocol that should support existing networking technology, which is capable of 130 Mbps UDP 🌸
so, as a result, MD5 cannot be used to support IP authentication in existing networks at existing rates 😭 Sure, MD5 will support higher bandwidth in the future thanks to technological advances, but those will be offset by similar advances in networking. If MD5 can't support existing network bandwidth using existing technology, it won't be able to scale as network speeds increase in the future.
This RFC proposes that MD5 be modified to support a 16-way block chaining, so existing technology (CMOS hardware) can support existing networking rates (1 Gbps) ✨ It further proposes that alternatives to MD5 be considered for use in high-speed networks 🔥
Acknowledgements 🫶
big shoutout to the author's besties 💜 Steve Kent at BBN, Burt Kaliski, Victor Chang, and Steve Burnett at RSA, Ran Atkinson at the NRL, and the HPCC Division at ISI all reviewed the contents of this document. Burt independently suggested the block-parallel modification proposed here 🙌
References 📚
[1] Atkinson, R., "IPv6 Authentication Header", Work in Progress, Naval Research Lab, February 1995.
[2] DiMarco, J., "Spec Benchmark table, V. 4.12", ftp://ftp.cfd.toronto.edu/pub/spectable.
[3] Rivest, R., "The MD5 Message-Digest Algorithm", RFC1321, MIT LCS & RSA Data Security, Inc., April 1992.
[4] Partridge, C., and F. Kastenholz, "Technical Criteria for Choosing IP The Next Generation (IPng)", RFC 1726, BBN Systems and Technologies, FTP Software, December 1994.
[5] Postel, J., "Internet Protocol - DARPA Internet Program Protocol Specification," STD 5, RFC 791, USC/Information Sciences Institute, September 1981.
[6] Touch, J., "Performance Analysis fo MD5," to appear in ACM Sigcomm '95, Boston.
[7] Touch, J., Optimized MD5 software, ftp://ftp.isi.edu/pub/hpcc-papers/touch/md5-opt.tar.
Author's Address 💌
and here's where you can find the author, Joe Touch 🦋
Joe Touch
Information Sciences Institute
University of Southern California
4676 Admiralty Way
Marina del Rey, CA 90292-6695
USA
Phone: +1 310-822-1511 x151
Fax: +1 310-823-6714
URL: ftp://ftp.isi.edu/pub/hpcc-papers/touch
EMail: touch@isi.edu📦 where this page comes from
- ietf: rfc1810 1995-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms