Hashing Algorithms

MD5

I often see the MD5 hashing algorithm used incorrectly. And while most databases support it by default, MD5 has been mathematically proven to be insecure. Given MD5, it is trivially easy to produce collisions on modern hardware. We’ve already seen it produce collisions earlier.

One of the most notable examples occurred in 2005. Researchers were able to generate collisions in MD5 checksums using a laptop. The significance of this is that it doesn’t take a $200k beast of a server to break MD5, just any old laptop, and that was in 2005. In 2005 people, that was like 100 internet years ago. No more MD5 for password hashing, please. Non-secure hashes to verify data contents, sure. Just not for secure hashes that an attacker would be interested in breaking.

MD5 is not entirely broken since it is still mostly secure when used with a suitable salt. But I still recommend that you should move on to a more future proof solution.

SHA-1

Ah, good old SHA-1, trusty and secure for years. Those are IRLIn Real Life years too; in internet years, that’s decades. In 2005 (a bad year for security apparently), researchers from Shandong University released a paper proving that SHA-1 collisions could be reliably generated with less than ...