Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

MD5 is a very fast hash and its output is short and easy to store. Should I use it for my non-security-sensitive application?

I don't think so, but I can't seem to convince anyone else that this is true.

share|improve this question
    
Can you provide more details on the application? What do you need a hash function for? –  mikeazo Jul 27 '12 at 19:18
    
The other day I made the argument that md5 should be replaced with sha-256 in a particular application. I wanted to sign the file digests. I was stunned by the fervent opposition to what I thought was a completely innocuous change. So I am asking for advice about how to better explain the harmlessness of strong hashing to my peers. –  joeforker Jul 27 '12 at 19:31
    
What are you using to sign the digests, PKI? –  mikeazo Jul 27 '12 at 19:59
    
@joeforker "and its output is easy to store" you do know you can truncate longer hashes, right? It has been discussed here before and it's generally considered to be a safe thing to do (provided you don't truncate too many bits). That leaves performance as the only plausible basis to use MD5... oh, hello SHA3! –  Thomas Jul 28 '12 at 4:01
    
@joeforker, since this question popped back up on my radar, I took another look at it. You say it is a non-security-sensitive application, but then you say you want to sign the file digests. Tell me if I have the application right. You have a file, you take the MD5 hash of it to compute the file's digest. You then sign that digest with an RSA key? If this is the case, then it is a scurity sensitive application and you should not use MD5. –  mikeazo Oct 15 '12 at 11:45

3 Answers 3

up vote 2 down vote accepted

When I need to show to others that they are wrong and it is their word against mine, I look to the words of industry recognized experts and then challenge them to find an industry recognized expert that supports their belief.

In this case, Bruce Schneier has written a lot on MD5 (in Bruce style, each word links to a different blog post or article of his).

Wikipedia even has a nice article on MD5 security.

That said, you specify in your question that this is potentially for a "non-security-sensitive" application. What do you mean by that? Your comment seems to suggest that you are signing hashes of files. That to me seems security sensitive.

share|improve this answer
    
It used to be a non-security application. The plan was to re-use the file for signing. –  joeforker Jul 27 '12 at 20:17
2  
Is security now a component of the application? We need to understand where the lines in your application are being drawn between intended security and no intended security. –  B-Con Jul 27 '12 at 20:33
1  
The main reason not to use MD5 is that you will have to convince people that it is safe and that will not be easy. You are not the only one who will have a queasy feeling. –  David Schwartz Jul 29 '12 at 12:23

If I was developing a new application and could use any hash function, and my application is even a little tiny bit security sensitive, my default is (soon) SHA-3.

Last year, my default hash function for anything even a little tiny bit security sensitive was SHA-256. It's about half as fast as MD5.

MD5 and SHA-1 are adequate for some applications, so there's no real rush to update all the software that currently uses it for those applications. But I would use the above alternatives instead for any new application, because:

US-CERT says MD5 "should be considered cryptographically broken and unsuitable for further use." NIST says "Federal agencies should stop using SHA-1 for...applications that require collision resistance as soon as practical, and must use the SHA-2 family of hash functions for these applications after 2010"

If I was implementing a non-security-sensitive hash table I would default to using the "Jenkins One-at-a-time hash".

If I need a hash to use as a checksum detect accidental (i.e., not malicious) bit errors, and it needed to be faster than SHA-256, I would probably by default use a CRC-32 if there was a library implementation handy and I had plenty of program space. If I needed to implement some kind of checksum myself -- or if it needed to use very little program space -- I would by default write a Fletcher-32 checksum implementation.

share|improve this answer

The only threats against MD5 are security, afaik it's mostly about its collision resistance (and some specific cases of preimage).

If you rite that app is "non-security-sensitive", maybe you should not care about those threats and gain from speed?

For some applications collisions are acceptable when happen very rarely - let's take hash tables as example.

If you app has similar requirements as Hash table datastructure, go and check out if there is even better choice than md5! (for speed, parallelism or other reason)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.