# What is the recommended replacement for MD5?

Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?

-

That depends on what you want to use the hash function for.

For signing documents, sha2 (e. g. sha512) is considered secure.

For storing passwords, you should use one of the algorithms dedicated for this purpose: e. g. bcrypt, sha512crypt or scrypt. In order to slow down an attacker, these algorithms apply the hash functions many times with an input that is based on the number of the current round.

Scrypt takes this concept one step further and uses a huge amount of memory. Typical hardware for password cracking has access to about a couple of KB of memory, the default configuration of scrypt requires 16 MB.

-
SHA-2 is actually one of SHA-224, SHA-256, SHA-384, and SHA-512. SHA-256 is considered secure for now. – Stephen Touset Oct 12 '12 at 22:07
@StephenTouset You forgot SHA-512/224 and SHA-512/256. – owlstead Oct 13 '12 at 16:02

Among the options for a replacement of MD5 as a hash function:

• RIPEMD-128 is an unbroken pin-compatible replacement of MD5, with a name. That would be perfectly fine if strong collision-resistance of the hash was not required in the application, and the objective of the change was to remove the word MD5 from the specification, without loosing too much speed or requiring much more memory. RIPEMD-128 is also regaining a sizable (if not strong) 64-bit security level against collisions, which MD5 no longer offers at all. RIPEMD-128 enjoys the same security argument as RIPEMD-160 (though with 4 rounds instead of 5). RIPEMD-160 in turn is AFAIK the single standard unbroken 160-bit hash, and has enjoyed the status of being vetted by European cryptographic authorities before the ban of all hashes less than 256-bit. Note: RIPEMD is broken like MD5 is, RIPEMD-128 is not.
• The-first-128-bits-of-SHA-256, if you relax the "with a name" and performance constraints just a tad, and accept using this even though the design objectives of SHA-2 say nothing about the properties of the first 128 bits.
• SHA-256 or SHA-512 if you can increase the width of the hash for strong collision resistance.

But beware: if you need to replace MD5 in an application where using a hash was a bad design choice in the first place, which include many uses in conjunction with password (protection of login information, or generation of a key from a password), then you do not want just to replace MD5; you want to change the design. For anything password-related, I would recommend scrypt when constraints allow (that is: there is ample memory; an efficient implementation of Salsa-20 is possible; and an appropriately secure implementation of SHA-256 is possible, which might be difficult if DPA is a consideration).

-
 Of course it really depends on what you mean by "standard" hash function; but some of the SHA-3 candidates offer extension for a 160-bit output size (e.g. Shabal) and, being SHA-3 candidates, they have reasonably clear specifications with test vectors and sample implementations. – Thomas Pornin Oct 12 '12 at 22:08 Just as the selected hash function from the SHA-3 competition, Keccack, allows variable output lengths in addition to the required output sizes from the NIST. – bob Oct 13 '12 at 8:32

One of the SHA2 hashes; if you don't have any preference between them, pick SHA256.

Those hashes are the most commonly accepted hashes we have. Eventually, NIST will select the Advanced Hash Standard; until then, the SHA2 hashes are the best we have.

-
 Is the name "Advanced Hash Standard" official? I didn't find it on the linked page (although it is the first thing Google finds for this keyword). – Paŭlo Ebermann♦ Jun 20 '12 at 20:05 @PaŭloEbermann: hmmmm, I had thought it was that was the official name (or, at least, an official name, in addition to "SHA-3"), but going through the NIST documents, I don't see it either. I guess that's just a nickname... – poncho Jun 20 '12 at 20:08 Bruce wanted AHS, but also thinks NIST does not use that name. – fgrieu Jun 21 '12 at 11:45 In their defense, it is hard to pronounce. – Thomas Oct 12 '12 at 22:23