MD5 Hash Algorithm Analysis: Modern Cryptography Explained

1. Introduction and Core Concepts

md5 hash algorithm analysis is the systematic study of the MD5 (Message-Digest Algorithm 5) cryptographic hash function, its internal design, security properties, performance characteristics, and practical applicability in modern systems. Designed by Ronald Rivest in 1991 as a successor to MD4, MD5 was once the de facto standard for integrity verification and cryptographic applications. Today, a thorough md5 hash algorithm analysis reveals both its elegant engineering and its critical vulnerabilities, making it an essential case study for anyone studying cryptographic algorithms.

At its core, MD5 is a deterministic, one-way hash function that takes an input of arbitrary length and produces a fixed-size 128-bit (16-byte) hash value, typically represented as a 32-character hexadecimal string. This fixed-length output, often called a digest or fingerprint, is designed to be unique to the input data. Even a single-bit change in the input should produce a completely different hash, a property known as the avalanche effect. md5 hash algorithm analysis focuses on how well MD5 achieves these ideal hash function properties: determinism, pre-image resistance, second pre-image resistance, and collision resistance.

Understanding MD5 matters today not because it should be used for new secure systems — it should not — but because it illustrates fundamental cryptographic design principles that underpin modern secure hash functions like SHA-256 and SHA-3. MD5 remains widely deployed in legacy systems, checksum verification, and non-security-critical applications where speed matters more than collision resistance. For developers, system administrators, and students, analyzing MD5 provides a concrete, relatively simple model to understand Merkle-Damgård construction, compression functions, and why cryptographic primitives fail over time due to advances in cryptanalysis and computing power.

What Defines a Cryptographic Hash Function?

A cryptographic hash function must satisfy several rigorous requirements beyond a simple checksum. First, it must be deterministic: the same input always yields the same output. Second, it must be fast to compute for any input size. Third, it must be infeasible to reverse: given a hash, you cannot reconstruct the original input (pre-image resistance). Fourth, it must be infeasible to find two different inputs that produce the same hash (collision resistance). md5 hash algorithm analysis evaluates MD5 against each of these criteria and shows where it succeeds and where it catastrophically fails.

MD5 was designed to be fast on 32-bit machines, simple to implement, and to provide strong security margins for its era. Its 128-bit output was considered sufficiently large in the early 1990s to make brute-force collision search infeasible, requiring approximately 2^64 operations due to the birthday paradox. However, cryptanalytic breakthroughs in 2004 by Xiaoyun Wang and colleagues demonstrated practical collision attacks, and by 2008 researchers could create a rogue Certificate Authority certificate using MD5 collisions. This history makes MD5 the perfect example of how theoretical weaknesses become practical exploits.

2. How It Works

MD5 operates using the Merkle-Damgård construction, which processes messages in fixed-size blocks through a compression function. The algorithm can be broken down into four distinct phases: padding, appending length, initializing buffers, and processing blocks through four rounds of nonlinear transformations. This structure ensures that any message, from empty to gigabytes in size, is transformed into a uniform 128-bit digest through a highly diffusive process.

The first phase is padding. The input message is padded so that its length in bits is congruent to 448 modulo 512. Padding always occurs, even if the message is already of the correct length. It begins with a single '1' bit (0x80 byte), followed by zero bits until the length condition is met. In the second phase, the original message length in bits is appended as a 64-bit little-endian integer. After these two steps, the total message length is an exact multiple of 512 bits (64 bytes), ready to be divided into blocks for processing.

MD5 maintains a 128-bit state divided into four 32-bit registers labeled A, B, C, and D, initialized to specific constants: A = 0x67452301, B = 0xEFCDAB89, C = 0x98BADCFE, D = 0x10325476. These are the fractional parts of the sines of integers, chosen to provide a pseudo-random starting point. Each 512-bit block is further divided into sixteen 32-bit words (M[0] to M[15]) and processed through 64 steps grouped into four rounds of 16 operations each. The output of one block becomes the starting state for the next, creating a chaining effect where every input bit influences the final hash.

The Four Rounds and Nonlinear Functions

Each of the 64 steps uses a different nonlinear function, a message word, a constant from a table T, and a rotation amount. The four auxiliary functions are: F(X,Y,Z) = (X AND Y) OR (NOT X AND Z), G(X,Y,Z) = (X AND Z) OR (Y AND NOT Z), H(X,Y,Z) = X XOR Y XOR Z, and I(X,Y,Z) = Y XOR (X OR NOT Z). Round 1 uses F, Round 2 uses G, Round 3 uses H, and Round 4 uses I. These functions provide confusion and ensure that the relationship between input and output is highly nonlinear.

In each step, the algorithm performs: temp = D; D = C; C = B; B = B + leftRotate((A + function(B,C,D) + M[k] + T[i]), s); A = temp. The constants T[i] are derived from the sine function: T[i] = floor(2^32 * abs(sin(i+1))), which eliminates any regular structure that could be exploited. The rotation amounts s are specified per step and vary to maximize diffusion. After all 64 steps, the values of A, B, C, D are added to the previous hash state. After the final block, the concatenation of A, B, C, D (in little-endian order) is the 128-bit MD5 digest.

The security of MD5 was intended to come from the avalanche effect created by this complex mixing. Ideally, flipping one input bit should flip approximately half of the output bits. While MD5 achieves good avalanche properties for random inputs, its compression function has structural weaknesses. The differential cryptanalysis that broke MD5 exploited the fact that differences introduced in one round could be canceled out in later rounds with higher-than-expected probability, allowing attackers to craft two different messages that follow a differential path to the same final hash.

3. Implementation

Implementing MD5 in Python is straightforward using the standard library, but understanding the low-level implementation reveals why md5 hash algorithm analysis is crucial for performance and security auditing. The following examples progress from high-level usage to manual construction of the padding and core functions, demonstrating both practical application and internal mechanics.

For production use, Python's hashlib provides a highly optimized C implementation of MD5. You should never implement MD5 from scratch for production security purposes, but a pure-Python version is invaluable for education. The key implementation details to note are byte encoding, incremental updating for large data, and the difference between digest, hexdigest, and binary output.

import hashlib

def md5_hash_basic(message: str) -> str:
    """Compute MD5 hex digest using hashlib."""
    # hashlib.md5 requires bytes input
    hasher = hashlib.md5()
    hasher.update(message.encode('utf-8'))
    return hasher.hexdigest()

# Example usage
messages = ["", "hello", "The quick brown fox jumps over the lazy dog"]
for msg in messages:
    print(f"'{msg}' -> {md5_hash_basic(msg)}")
# Output:
# '' -> d41d8cd98f00b204e9800998ecf8427e
# 'hello' -> 5d41402abc4b2a76b9719d911017c592
# 'The quick brown fox...' -> 9e107d9d372bb6826bd81d3542a419d6

This first implementation shows the idiomatic way to hash strings and demonstrates incremental hashing. The update() method can be called multiple times, which is essential for hashing large files or network streams without loading everything into memory. A common mistake is to forget to encode strings to bytes, which will raise a TypeError, or to use different encodings (UTF-8 vs ASCII) and get inconsistent hashes across systems.

import math

# MD5 auxiliary functions F, G, H, I
def F(x, y, z):
    return (x & y) | (~x & z)

def G(x, y, z):
    return (x & z) | (y & ~z)

def H(x, y, z):
    return x ^ y ^ z

def I(x, y, z):
    return y ^ (x | ~z)

def left_rotate(x, n):
    # Circular left shift: (x << n) | (x >> (32 - n))
    return ((x << n) | (x >> (32 - n))) & 0xFFFFFFFF

# Constants T[i] = floor(2**32 * abs(sin(i+1)))
T = [int((1 << 32) * abs(math.sin(i + 1))) & 0xFFFFFFFF for i in range(64)]

# Per-round shift amounts
S = [7, 12, 17, 22] * 4 + [5, 9, 14, 20] * 4 + [4, 11, 16, 23] * 4 + [6, 10, 15, 21] * 4

def md5_pad(message_bytes: bytes) -> bytes:
    """Apply MD5 padding: append 0x80, zeros, and 64-bit length."""
    orig_len_bits = (8 * len(message_bytes)) & 0xFFFFFFFFFFFFFFFF
    # Append 1 bit (0x80)
    padded = message_bytes + b'\x80'
    # Pad with zeros until length ≡ 56 (mod 64)
    while len(padded) % 64 != 56:
        padded += b'\x00'
    # Append original length as 64-bit little-endian
    padded += orig_len_bits.to_bytes(8, byteorder='little')
    return padded

# Example: padded length is always multiple of 64 bytes
print(len(md5_pad(b"abc")))  # 64 bytes (512 bits) for short message
print(len(md5_pad(b"a" * 55)))  # 64 bytes
print(len(md5_pad(b"a" * 56)))  # 128 bytes (needs extra block)

This second block exposes the core primitives that md5 hash algorithm analysis examines. Note the use of bitwise operations and the sine-based constants T. The padding function is a frequent source of bugs in custom implementations: failing to append the 0x80 byte correctly, using big-endian instead of little-endian for the length, or mishandling messages that are exactly 56 bytes modulo 64 and therefore require an additional 512-bit block. The left rotate operation must be masked with 0xFFFFFFFF to simulate 32-bit unsigned integer overflow in Python's arbitrary-precision integers.

import hashlib
import os

def md5_file(filepath: str, chunk_size: int = 8192) -> str:
    """Compute MD5 for large files without loading into memory."""
    hasher = hashlib.md5()
    # Read file in chunks to handle large files efficiently
    with open(filepath, 'rb') as f:
        while True:
            chunk = f.read(chunk_size)
            if not chunk:
                break
            hasher.update(chunk)
    return hasher.hexdigest()

def md5_bytes_incremental(data_chunks) -> str:
    """Demonstrate incremental hashing for network streams."""
    hasher = hashlib.md5()
    for chunk in data_chunks:
        # Each chunk can be processed as it arrives
        hasher.update(chunk)
        # Intermediate digest not final until all chunks processed
    return hasher.hexdigest()

# Simulated network stream
chunks = [b'Hello, ', b'world', b'! This ', b'is chunked.']
print(md5_bytes_incremental(chunks))
# Same as hashing concatenated bytes
print(hashlib.md5(b''.join(chunks)).hexdigest())

The file hashing example is the most common real-world use of MD5 today: verifying download integrity. By reading in 8KB chunks, memory usage remains constant regardless of file size, which is critical for web servers and databases handling multi-gigabyte files. This pattern also applies to hashing network streams where data arrives incrementally. From a performance perspective, hashlib's MD5 can process hundreds of megabytes per second on modern hardware, which is why it remains attractive for non-cryptographic checksums despite its security flaws.

import hashlib
import secrets

def demonstrate_avalanche():
    """Show avalanche effect: small change causes large hash difference."""
    msg1 = b"hello world"
    msg2 = b"hello worle"  # One character changed
    h1 = hashlib.md5(msg1).hexdigest()
    h2 = hashlib.md5(msg2).hexdigest()
    # Count differing hex characters
    diff = sum(c1 != c2 for c1, c2 in zip(h1, h2))
    print(f"MD5('{msg1.decode()}') = {h1}")
    print(f"MD5('{msg2.decode()}') = {h2}")
    print(f"Hex characters differing: {diff} / 32")

def insecure_password_hash(password: str) -> str:
    """INSECURE: Do NOT use MD5 for passwords."""
    return hashlib.md5(password.encode()).hexdigest()

def secure_password_hash(password: str) -> str:
    """Secure alternative using SHA-256 with salt and stretching."""
    salt = secrets.token_hex(16)
    # Use PBKDF2-HMAC-SHA256 with 200,000 iterations
    dk = hashlib.pbkdf2_hmac('sha256', password.encode(), salt.encode(), 200000)
    return f"{salt}${dk.hex()}"

demonstrate_avalanche()
# Compare insecure vs secure
print(insecure_password_hash("password123"))
print(secure_password_hash("password123"))

The final implementation contrasts insecure and secure practices. The avalanche demonstration quantifies diffusion: changing one byte from 'd' to 'e' should change roughly 16 of the 32 hex characters. The insecure password function shows what not to do: unsalted, single-iteration MD5 is vulnerable to rainbow tables and GPU brute force at billions of hashes per second. The secure alternative uses a random salt and PBKDF2 key stretching with SHA-256, making each password hash unique and computationally expensive to attack. This comparison is central to md5 hash algorithm analysis in security audits.

4. Step-by-Step Example

To make md5 hash algorithm analysis concrete, let us walk through the complete hashing of the message "abc" (0x61, 0x62, 0x63), which is the standard test vector from RFC 1321. The expected MD5 digest for "abc" is 900150983cd24fb0d6963f7d28e17f72. Tracing this example reveals every transformation the algorithm performs.

Step 1: Padding. The message is 3 bytes (24 bits). We append 0x80, then 52 zero bytes (since 3 + 1 + 52 = 56), then the 64-bit little-endian length (24 = 0x0000000000000018). The final padded block in hex is: 61 62 63 80 00 00 ... 00 18 00 00 00 00 00 00 00. This is exactly 64 bytes (512 bits). The 16 words M[0]..M[15] in little-endian interpretation are: M[0]=0x80636261, M[1]=0x00000000, ..., M[14]=0x00000018, M[15]=0x00000000. Note how the ASCII bytes appear reversed within the first word due to little-endian ordering.

Step 2: Initialization. Set A=0x67452301, B=0xEFCDAB89, C=0x98BADCFE, D=0x10325476. Save these as AA, BB, CC, DD for final addition. Step 3: Round 1 (16 steps using F). For i=0, k=0, s=7, T[0]=0xD76AA478: temp = D, D=C, C=B, B = B + leftRotate((A + F(B,C,D) + M[0] + T[0]), 7). F(B,C,D) = (B & C) | (~B & D) = 0x98BADCFE. So A + F + M0 + T0 = 0x67452301 + 0x98BADCFE + 0x80636261 + 0xD76AA478 = 0x6A2E8B7E (mod 2^32). Left rotate by 7 gives 0x1726F6D1, add B gives 0x07A2A1D6. Thus after step 0, B becomes 0x07A2A1D6 while A=0x10325476, C=0xEFCDAB89, D=0x98BADCFE. This process repeats for 15 more steps with varying k, s, and T.

Step 4: Rounds 2-4. Round 2 uses G and processes message words in order k = (1 + 5*i) mod 16, with shifts [5,9,14,20]. Round 3 uses H with k = (5 + 3*i) mod 16, shifts [4,11,16,23]. Round 4 uses I with k = (7*i) mod 16, shifts [6,10,15,21]. Each round introduces different diffusion patterns. For example, in Round 2 step 16 (i=16), k=1, we add M[1]=0x00000000 and T[16]=0xF61E2562. The chaining ensures that every message bit has influenced every state register multiple times by the end of Round 4.

Step 5: Finalization. After 64 steps, suppose the working registers are A=0x310ade8f, B=0x1f6c0d9a, C=0x3ea2d67e, D=0x8b0a1f3c (intermediate values illustrative). We add the original values: A = A + AA, B = B + BB, etc., modulo 2^32. The final little-endian concatenation of A,B,C,D yields bytes: 90 01 50 98 3c d2 4f b0 d6 96 3f 7d 28 e1 7f 72, which as a hex string is 900150983cd24fb0d6963f7d28e17f72. Verifying this against hashlib confirms correctness. This walkthrough shows why even the three-byte input requires 64 complex operations and why cryptanalysis must account for all 64 steps to find collisions.

Observing the Avalanche Effect

If we change "abc" to "abd" (increment last byte by one), the padded block changes only in M[0] from 0x80636261 to 0x80646261. Yet the final hash becomes 4911e516e18f38697d416a6b9ea2d0e4, differing in 30 of 32 hex characters from the "abc" hash. This dramatic change demonstrates diffusion but also highlights that diffusion alone does not guarantee collision resistance. Attackers do not need to reverse the hash; they need to find two different padded messages that converge to the same state after 64 steps, which is a more subtle property than simple avalanche.

5. Complexity Analysis

md5 hash algorithm analysis of complexity is straightforward because MD5 is a deterministic, linear-time algorithm with constant space. Unlike comparison-based sorting or searching algorithms that have varying best and worst cases based on input order, MD5's runtime depends solely on input length, not content. Every input bit is processed exactly once through the same sequence of operations, making performance highly predictable, which is advantageous for systems requiring consistent latency.

Time complexity is O(n) where n is the message length in bytes. More precisely, for a message of L bytes, the padded length is ceil((L+9)/64)*64 bytes, which is processed as ceil((L+9)/64) blocks. Each block requires exactly 64 steps, each step performing a constant number of 32-bit operations (bitwise logic, addition, rotation). Therefore total operations are approximately 64 * (L/64) = O(L). There is no early termination or data-dependent branching that would create best or worst cases; hashing "aaaa..." and hashing random bytes of the same length take identical time. The constant factor is very low, with only a few CPU instructions per step, which explains MD5's high throughput.

Space complexity is O(1) auxiliary space. MD5 requires only the four 32-bit state registers, a 64-byte buffer for the current block, and the 64-entry constant table T (256 bytes). Even when hashing multi-gigabyte files incrementally, memory usage remains constant because only one block is held at a time. The input itself is not counted in auxiliary space, and the padded message does not need to be stored entirely; padding can be generated on the fly for the final block. This makes MD5 suitable for memory-constrained embedded systems and for streaming data in network protocols.

The table clarifies that MD5 has no meaningful best or worst case distinction for honest hashing; the complexity is uniform. The last row, however, shows the attack complexity, which is where md5 hash algorithm analysis reveals failure. The ideal collision resistance for a 128-bit hash should be O(2^64) via the birthday attack, and preimage resistance should be O(2^128). While brute-force preimage still requires 2^128, practical collision attacks on MD5 now require as little as 2^18 to 2^32 operations due to differential cryptanalysis, far below the birthday bound. This means an attacker can find collisions in seconds on a laptop, not in billions of years.

From a systems perspective, MD5 throughput is typically 400-600 MB/s per core on modern x86-64 CPUs using optimized implementations, compared to 200-300 MB/s for SHA-256 and 800+ MB/s for BLAKE2. This speed advantage is why MD5 persists in non-cryptographic uses like checksums for large file transfers, where O(n) with a small constant matters more than security. However, for password hashing, the fact that MD5 is fast is a liability: attackers can test billions of passwords per second on GPUs, so deliberately slow algorithms like bcrypt or Argon2 with time complexity tunable to O(2^k) iterations are required.

6. Variations and Optimizations

MD5 has spawned several variants and optimization techniques, both to improve performance and to attempt to salvage security. Understanding these variations is essential for md5 hash algorithm analysis because they illustrate how cryptographic designs evolve and how not to fix a broken primitive. The most direct relatives are MD4, MD5, and the HMAC construction, while modern optimizations focus on SIMD parallelism and hardware acceleration.

MD4, designed in 1990, is MD5's predecessor with only three rounds (48 steps) and simpler message scheduling. MD5 added a fourth round, reordered message words, and introduced unique constants T to strengthen against the attacks that broke MD4. Ironically, MD5's extra complexity was insufficient. HMAC-MD5 (Hash-based Message Authentication Code) combines MD5 with a secret key: HMAC(K,m) = MD5((K' XOR opad) || MD5((K' XOR ipad) || m)). HMAC-MD5 remains considered secure for message authentication even though MD5 alone is broken, because the key prevents the attacker from controlling the inner hash input to exploit collisions. However, new systems should still prefer HMAC-SHA256.

Performance optimizations for MD5 focus on exploiting data parallelism. Since MD5 processes blocks sequentially (each block depends on the previous hash state), you cannot parallelize a single message. But you can hash multiple independent messages in parallel using SIMD instructions (SSE, AVX2, AVX-512) or GPU threads, achieving 4x to 16x throughput for bulk hashing of many small inputs, such as hashing database records or files in a directory. Another optimization is to precompute the T table and use loop unrolling to eliminate branching in the 64 steps, which compilers and hand-tuned assembly do automatically. For large files, using larger chunk sizes (64KB vs 8KB) reduces Python overhead and system call frequency.

Should You Optimize MD5 or Replace It?

A common pitfall is attempting to "strengthen" MD5 by double hashing (MD5(MD5(m))) or by truncating or salting it. md5 hash algorithm analysis shows these do not restore collision resistance: if you can find m1 != m2 with MD5(m1)=MD5(m2), then MD5(MD5(m1))=MD5(MD5(m2)) trivially, so double hashing offers no protection. Salting (appending random data) prevents rainbow table attacks for password storage but does not prevent collision attacks where the attacker controls both messages. The only valid optimization for security is migration: use SHA-256, SHA-3, or BLAKE2 for integrity, and Argon2 or scrypt for passwords.

For non-security uses where MD5 speed is desired but 128-bit output is too small, variants like MD5-128 truncated to 64 bits are sometimes used for hash tables. This is acceptable for hash tables where collisions only cause performance degradation, not security compromise, but you must handle collisions via chaining or open addressing. In such contexts, even faster non-cryptographic hashes like MurmurHash, xxHash, or CityHash may be preferable, offering 2-5x higher throughput than MD5 with similar distribution properties but no cryptographic claims.

7. Real-World Applications

Despite being cryptographically broken, MD5 remains surprisingly prevalent in real-world systems, which is why md5 hash algorithm analysis is practically relevant for auditing legacy code and designing migrations. Its applications fall into two categories: legacy security uses that must be replaced, and non-security checksum uses where its speed and ubiquity still provide value. Distinguishing these is critical for risk assessment.

In web servers and CDNs, MD5 was historically used for ETags (entity tags) to validate cached content. When a browser requests a resource, the server sends an ETag like "5d41402abc4b2a76b9719d911017c592"; on subsequent requests the browser sends If-None-Match, and the server can return 304 Not Modified without resending the body if the hash matches. While still seen in older Apache and Nginx configurations, modern deployments should use SHA-256 or weak ETags based on file metadata, because an attacker who can generate collisions could potentially poison caches or bypass integrity checks.

In databases, MD5 has been used for deduplication, indexing, and change detection. For example, MySQL's MD5() function and PostgreSQL's md5() are often used to find duplicate files or rows: SELECT md5(content) GROUP BY md5(content) HAVING COUNT(*) > 1. It is also used to create hash indexes for long text columns where B-tree indexing would be inefficient. For these non-adversarial uses, MD5 collisions are astronomically unlikely for random data (probability ~1 in 2^64 for 2^32 entries), so the risk is negligible. However, if an adversary can insert data, they could craft collisions to cause deduplication to incorrectly merge distinct records.

Networks and file distribution rely heavily on MD5 checksums. Linux ISO images, software packages, and data archives often publish an MD5SUMS file alongside downloads. Users run md5sum file.iso to verify the download was not corrupted in transit. This protects against accidental bit flips but not against a malicious mirror that could serve a tampered file with the same MD5. For this reason, major distributions now publish SHA256SUMS and GPG signatures. Similarly, the rsync protocol and file synchronization tools use rolling checksums inspired by MD5 for delta encoding, though they have moved to stronger hashes for security.

The table summarizes the risk spectrum. The key takeaway from md5 hash algorithm analysis is that MD5 is safe only when collisions do not benefit an attacker. For any context where an attacker can influence the hashed data and benefit from a collision — passwords, signatures, authenticated downloads — MD5 must be considered compromised. For purely accidental error detection where performance is paramount and data is trusted, MD5 remains functional but is increasingly replaced by faster non-cryptographic hashes that do not carry the stigma of being "broken."

8. Comparison with Alternatives

Choosing a hash function requires balancing output size, speed, security, and ecosystem support. md5 hash algorithm analysis is incomplete without comparing MD5 to its contemporaries and successors. The landscape includes SHA-1 (also broken), the SHA-2 family (SHA-256, SHA-512), SHA-3 (Keccak), and modern high-performance hashes like BLAKE2 and BLAKE3. Each makes different trade-offs between security margin and performance.

MD5 and SHA-1 share the Merkle-Damgård construction and 32-bit operations, but SHA-1 produces 160 bits and has 80 steps, offering a higher theoretical security level. However, SHA-1 is also broken: the SHAttered attack in 2017 demonstrated practical collisions at a cost of ~2^63 operations, down from the ideal 2^80. Both MD5 and SHA-1 are now deprecated for security use by NIST. SHA-256, part of SHA-2, uses 64 rounds, 256-bit output, and 32-bit operations with stronger message scheduling, providing 128-bit collision resistance and no known practical attacks. SHA-512 is similar but uses 64-bit words and 80 rounds, performing better on 64-bit CPUs.

SHA-3, standardized in 2015, is based on the Keccak sponge construction, fundamentally different from Merkle-Damgård. It offers variable output lengths, resistance to length-extension attacks, and a very different security argument. BLAKE2, an evolution of the SHA-3 finalist BLAKE, is optimized for speed while maintaining security comparable to SHA-3, often outperforming MD5 on modern CPUs due to its parallelizable design and fewer rounds. For password hashing, none of these fast hashes are appropriate; dedicated password hashing functions like Argon2 add memory hardness and tunable cost.