What is the recommended replacement for MD5?

Question

Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?

Answer 1

Among the options for a replacement of MD5 as a hash function:

• RIPEMD-128 is an unbroken pin-compatible replacement of MD5, with a name. That would be perfectly fine if strong collision-resistance of the hash was not required in the application, and the objective of the change was to remove the word MD5 from the specification, without loosing too much speed or requiring much more memory. RIPEMD-128 is also regaining a sizable (if not strong) 64-bit security level against collisions, which MD5 no longer offers at all. RIPEMD-128 enjoys the same security argument as RIPEMD-160 (though with 4 rounds instead of 5). RIPEMD-160 in turn is AFAIK the single standard unbroken 160-bit hash, and has enjoyed the status of being vetted by European cryptographic authorities before the ban of all hashes less than 256-bit. Note: RIPEMD is broken like MD5 is, RIPEMD-128 is not.
• The-first-128-bits-of-SHA-256, if you relax the "with a name" and performance constraints just a tad, and accept using this even though the design objectives of SHA-2 say nothing about the properties of the first 128 bits.
• SHA-256 or SHA-512 if you can increase the width of the hash for strong collision resistance.

But beware: if you need to replace MD5 in an application where using a hash was a bad design choice in the first place, which include many uses in conjunction with password (protection of login information, or generation of a key from a password), then you do not want just to replace MD5; you want to change the design. For anything password-related, I would recommend scrypt when constraints allow (that is: there is ample memory; an efficient implementation of Salsa-20 is possible; and an appropriately secure implementation of SHA-256 is possible, which might be difficult if DPA is a consideration).

Answer 2

That depends on what you want to use the hash function for.

For signing documents, sha2 (e. g. sha512) is considered secure.

For storing passwords, you should use one of the algorithms dedicated for this purpose: e. g. bcrypt, sha512crypt or scrypt. In order to slow down an attacker, these algorithms apply the hash functions many times with an input that is based on the number of the current round.

Scrypt takes this concept one step further and uses a huge amount of memory. Typical hardware for password cracking has access to about a couple of KB of memory, the default configuration of scrypt requires 16 MB.

Answer 3

One of the SHA2 hashes; if you don't have any preference between them, pick SHA256.

Those hashes are the most commonly accepted hashes we have. Eventually, NIST will select the Advanced Hash Standard; until then, the SHA2 hashes are the best we have.