@robert2003b thanks for your reply, I think I may have tracked this one down. The answer is that the MD5 hash that Cisco ACI calculates for its backup files is not prepended with 0's to reach a certain length.
How I reached that conclusion: Since Windows certutil and Python's hashlib weren't calculating the MD5 hash the same as Cisco was, I discovered that Java has a broken method that can also generate MD5 hashes with missing 0's because Java's Integer.toHexString method "will not prepend 0's to the length you implicitly desire."
Zeros missing from md5 hash in java - Stack Overflow
In other words, programs like certutil, Python's hashlib library, and even the md5sum program on a Cisco ACI APIC, they all will prepend the MD5 with 0's so the MD5 hash is a certain length (from my initial post above, 32 characters long). It appears that Cisco ACI doesn't prepend the MD5 hash when calculating it for ACI backups.
To replicate this, I found a Java script that, with a little modification, creates the same MD5 hashes that Cisco ACI does for its backup files:
How to Generate MD5 Checksum for Files in Java? - GeeksforGeeks
The code sample on that page will generate MD5 hashes the same as Windows and all the others - 32 characters long. However, with a little modification using that Integer.toHexString method we saw above, we can change the java code so it won't prepend the MD5 hash with 0's, so the MD5 hash will be the same as for Cisc ACI backups. So, if we take the code from the link above and we comment out lines 76-79 and replace them with this single line:
sb.append(Integer.toHexString((bytes[i]& 0xFF)));
we can achieve what we want - an MD5 hash that isn't prepended with 0's, so it will be the same as Cisco's ACI hash for its backup files. The full java code is pasted below for reference:
// Java program to Generate MD5 Checksum for Files
import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
public class GFG {
// this method gives a NoSuchAlgorithmException in case
// we pass a string which doesn't have any hashing
// algorithm in its correspondence
public static void main(String[] args)
throws IOException, NoSuchAlgorithmException
{
// create a file object referencing any file from
// the system of which checksum is to be generated
File file = new File("C:\\ftp\\ACI-BACKUP-FILE.xml");
// instantiate a MessageDigest Object by passing
// string "MD5" this means that this object will use
// MD5 hashing algorithm to generate the checksum
MessageDigest mdigest = MessageDigest.getInstance("MD5");
// Get the checksum
String checksum = checksum(mdigest, file);
// print out the checksum
System.out.println(checksum);
}
// this method return the complete hash of the file
// passed
private static String checksum(MessageDigest digest,
File file)
throws IOException
{
// Get file input stream for reading the file
// content
FileInputStream fis = new FileInputStream(file);
// Create byte array to read data in chunks
byte[] byteArray = new byte[1024];
int bytesCount = 0;
// read the data from file and update that data in
// the message digest
while ((bytesCount = fis.read(byteArray)) != -1)
{
digest.update(byteArray, 0, bytesCount);
};
// close the input stream
fis.close();
// store the bytes returned by the digest() method
byte[] bytes = digest.digest();
// this array of bytes has bytes in decimal format
// so we need to convert it into hexadecimal format
// for this we create an object of StringBuilder
// since it allows us to update the string i.e. its
// mutable
StringBuilder sb = new StringBuilder();
// loop through the bytes array
for (int i = 0; i < bytes.length; i++) {
// the following line converts the decimal into
// hexadecimal format and appends that to the
// StringBuilder object
//sb.append(Integer
//.toString((bytes[i] & 0xff) + 0x100, 16)
//.substring(1));
//sb.append(Integer.toHexString((bytes[i]& 0xFF) | 0x100).substring(1));
sb.append(Integer.toHexString((bytes[i]& 0xFF)));
}
// finally we return the complete hash
return sb.toString();
}
}
0xD2A6762E
