I recently have a problem with a crypto library which produces bad md5 output. Instead of 32 digits it returns 30.
As we don’t use unit test, this problem was quite a headache to solve… because we assumed that md5 string was correct and look for bugs in other places.
That make me realize of the real value of unit tests (unit test first, tdd later).
But I’m not sure how to test cryptographic methods well enough. How do you get proper expected values?
EDIT: Thanks for the answers, I think I didn’t explain it enough.
The problem was with a third party tool wich produces bad md5 output. Then, how do you get that assert value? I know it mustn’t change, just I don’t get how to obtain it from a reliable source.
Known correct data for cryptographic algorithms is usually called test vectors. So google "MD5 test vectors" to get a ton of good input data for your tests.
The most authoritative resource for test vectors is of course the document defining the algorithm. Most standards documents will include a set of test vectors. For instance, RFC 1321 contains the following set of test data: