CryptoKit - Insecure.MD5Digest.byteCount is 20?

My limited understanding of md5 is that the result will be 128 bits, and 128 / 8 = 16 bytes, which is the same as CC_MD5_DIGEST_LENGTH from CommonCrypto. However, when I use Insecure.MD5 from CryptoKit, the digest has 20 bytes with zeros at the end!


I'm not sure if Insecure.MD5Digest.byteCount is intended to be 20, or is this by mistake?

Replies

Chiming in from the future - in case anyone else runs into this, iOS 13.0 does appear to have shipped with this bug. I've verified that I don't see it in any revision beyond 13.0 and thus now available check MD5s with 13.1 instead of 13.0, relying on CommonCrypto for the rest.

Some of our users are seeing the same issue with iOS 13.6. However, I'm not able to reproduce it on any device.