# What is the recommended replacement for MD5?

Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?

-

That depends on what you want to use the hash function for.

For signing documents, sha2 (e. g. sha512) is considered secure.

For storing passwords, you should use one of the algorithms dedicated for this purpose: e. g. bcrypt, sha512crypt or scrypt. In order to slow down an attacker, these algorithms apply the hash functions many times with an input that is based on the number of the current round.

Scrypt takes this concept one step further and uses a huge amount of memory. Typical hardware for password cracking has access to about a couple of KB of memory, the default configuration of scrypt requires 16 MB.

-
SHA-2 is actually one of SHA-224, SHA-256, SHA-384, and SHA-512. SHA-256 is considered secure for now. –  Stephen Touset Oct 12 '12 at 22:07
@StephenTouset You forgot SHA-512/224 and SHA-512/256. –  Maarten Bodewes Oct 13 '12 at 16:02

Among the options for a replacement of MD5 as a hash function:

• (Updated again) A candidate worth examination is RIPEMD-128, a pin-compatible replacement of MD5, with a name. RIPEMD-128 uses the same security argument as RIPEMD-160 (though with 4 groups of rounds instead of 5). RIPEMD-160 in turn is AFAIK the single standard unbroken 160-bit hash, and has enjoyed the status of being vetted by European cryptographic authorities before the ban of all hashes less than 256-bit. RIPEMD-128 has been broken threatened in late 2013, by an attack (theoretically) finding collision on the round function with about 5 times less work than brute force; that's not devastating (at all: the attack does not extend to a collision for the complete hash), but it is a break, and as the saying goes: attacks only get better; they never get worse. Despite that break, when moderate resistance to collision is enough, RIPEMD-128 would remain a better choice than MD5, if the objective of the change was to remove the word MD5 from the specification, without changing anything else, nor loosing too much speed or requiring much more memory. Note: RIPEMD, an ancestor of RIPEMD-128, is broken like MD5 is, and must not be used.
• A safer more conservative choice would be the-first-128-bits-of-SHA-256, if you relax the "with a name" and performance constraints just a tad.
• Or better, SHA-256 or SHA-512 if you can increase the width of the hash for strong collision resistance.

But beware: if you need to replace MD5 in an application where using a hash was a bad design choice in the first place, which include many uses in conjunction with password (protection of login information, or generation of a key from a password), then you do not want just to replace MD5; you want to change the design. For anything password-related, I would recommend scrypt when constraints allow (that is: there is ample memory; an efficient implementation of Salsa-20 is possible; and an appropriately secure implementation of SHA-256 is possible, which might be difficult if DPA is a consideration).

-
Of course it really depends on what you mean by "standard" hash function; but some of the SHA-3 candidates offer extension for a 160-bit output size (e.g. Shabal) and, being SHA-3 candidates, they have reasonably clear specifications with test vectors and sample implementations. –  Thomas Pornin Oct 12 '12 at 22:08
Just as the selected hash function from the SHA-3 competition, Keccack, allows variable output lengths in addition to the required output sizes from the NIST. –  bob Oct 13 '12 at 8:32
As of September, RIPEMD-128 is now considered broken, and RIPEMD-160 is on a shorter leash –  Richie Frame Nov 1 '13 at 8:45

What about SHA-3, which uses a sponge construction instead of Merkle-Damgard construction, which implies resistance to length extension attacks, unlike SHA-256 and SHA-512.

-
AFAIK SHA-3 isn't specified yet, if you want to use it now you need to use a Keccak variant that'll be slightly different from the final SHA-3. So I recommend waiting until the SHA-3 standard is actually published. –  CodesInChaos Jul 5 '13 at 6:28
I know that, the SHS hasn't been updated yet. But I expect it to be updated maybe end of 2013 or start of 2014. –  Gavriel Feria Jul 6 '13 at 22:59

One of the SHA2 hashes; if you don't have any preference between them, pick SHA256.

Those hashes are the most commonly accepted hashes we have. Eventually, NIST will select the Advanced Hash Standard; until then, the SHA2 hashes are the best we have.

-
Is the name "Advanced Hash Standard" official? I didn't find it on the linked page (although it is the first thing Google finds for this keyword). –  Paŭlo Ebermann Jun 20 '12 at 20:05
@PaŭloEbermann: hmmmm, I had thought it was that was the official name (or, at least, an official name, in addition to "SHA-3"), but going through the NIST documents, I don't see it either. I guess that's just a nickname... –  poncho Jun 20 '12 at 20:08
Bruce wanted AHS, but also thinks NIST does not use that name. –  fgrieu Jun 21 '12 at 11:45
In their defense, it is hard to pronounce. –  Thomas Oct 12 '12 at 22:23