EMZETT.
Login

Emzett Wiki

MD5 and SHA-1: Why old hash methods are no longer secure

Properties1
tagsglossar, krypto, hash

2 min read

MD5 and SHA-1: Why old hash methods are no longer secure

In short: MD5 and SHA-1 are broken by collision attacks; for security use SHA-256, SHA-3 or BLAKE3, for passwords special slow methods such as Argon2.

In more detail: A hash function turns arbitrary data into a short fingerprint. It is secure if (1) the data cannot be derived from the hash (one-way function), (2) no other input with the same hash can be found (second pre-image) and (3) no two inputs with the same hash can be found (collision resistance). MD5 and SHA-1 violate (3).

In Depth

What happened?

  • MD5 (1992, 128 bits): by 2004/2008 collisions computable in seconds. Researchers produced forged certificates (2008) and the Flame malware used an MD5 collision to forge Windows Update signatures.
  • SHA-1 (1995, 160 bits): in 2017 Google and CWI showed the first practical collision with SHAttered (two different PDFs with the same hash). Since then the attack has become cheaper (chosen-prefix collisions, 2020). Browsers, certificate authorities and Git (gradual switch to SHA-256) have reacted.

Where they still appear

MD5 is still used for checksums against transmission errors (harmless as long as no attacker is involved), in old systems and file formats, for password hashes in poorly built databases (dangerous!). SHA-1 is in Git (commit IDs), old certificates and signatures, HMAC-SHA1 (still usable, but do not newly deploy it). Download checksums should be given with SHA-256.

What to use instead

  • SHA-256/SHA-512 (SHA-2 family): standard for integrity, signatures, certificates.
  • SHA-3: different internal construction (Keccak).
  • BLAKE2/BLAKE3: very fast, modern.
  • Passwords: never simple hashes but Argon2id, scrypt or bcrypt with salt (deliberately slow and memory-hungry) so that brute force and rainbow tables fail.
  • With a key: HMAC-SHA256.

Practice

Check where MD5/SHA-1 occur in your projects (search code, dependencies, configuration). For passwords migrate to Argon2/bcrypt at the next login. Compare checksums (sha256sum file). Cryptographic agility (keeping algorithms replaceable) makes later changes easier. For hash tables in a program collision resistance is less important; speed and distribution matter there.

See also: SHA-256, Hashing, Storing passwords safely, Argon2