# What is the recommended replacement for MD5?

Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?

• Note that a 128-bit hash requires about $2^{64}$ evaluations to find a collision, which is feasible (and in fact more work has been done to find the SHA-1 collision).
– SEJPM
Mar 20 '17 at 11:28

That depends on what you want to use the hash function for.

For signing documents, sha2 (e. g. sha512) is considered secure.

For storing passwords, you should use one of the algorithms dedicated for this purpose: e. g. bcrypt, sha512crypt or scrypt. In order to slow down an attacker, these algorithms apply the hash functions many times with an input that is based on the number of the current round.

Scrypt takes this concept one step further and uses a huge amount of memory. Typical hardware for password cracking has access to about a couple of KB of memory, the default configuration of scrypt requires 16 MB.

• SHA-2 is actually one of SHA-224, SHA-256, SHA-384, and SHA-512. SHA-256 is considered secure for now. Oct 12 '12 at 22:07
• @StephenTouset You forgot SHA-512/224 and SHA-512/256. Oct 13 '12 at 16:02

Among the options for a replacement of MD5 as a hash function:

• If at all possible, you should increase the width of the hash for strong collision resistance, and use an at-least-256 bit member of the SHA-2, or perhaps the new SHA-3 family. The collision resistance of any 128-bit hash can be broken by educated brute force and about $2^{65}$ hashes (which is feasible for decently fast hashes and modern means) using Paul C. van Oorschot and Michael J. Wiener's Parallel Collision Search with Cryptanalytic Applications (in Journal of Cryptology, January 1999, Volume 12, Issue 1; free slightly earlier version available from the first author's website).
• If a 128-bit replacement is thought despite the above (which would be rational in applications where collision resistance is not an issue, and perhaps in HMAC)
• a candidate worth examination is RIPEMD-128, a pin-compatible replacement of MD5, with a name. RIPEMD-128 uses the same security argument as RIPEMD-160 (though with 4 groups of rounds instead of 5). RIPEMD-160 in turn is AFAIK the single standard unbroken 160-bit hash, and has enjoyed the status of being vetted by European cryptographic authorities before the ban of all hashes less than 256-bit. RIPEMD-128 has been threatened in late 2013, by an attack (theoretically) finding collision on the round function for different chaining variable inputs with about 5 times less work than brute force. However RIPEMD128 should not be considered broken (as stated in this comment), because the attack does not yield a hash collision for different messages, and was not extended to that (as far as I can tell as of early 2017). But as the saying goes, attacks only get better; they never get worse.
Despite that partial attack, when moderate resistance to collision is enough, RIPEMD-128 would remain a better choice than MD5, if the objective of the change was to remove the word MD5 from the specification, without changing anything else, nor loosing too much speed or requiring much more memory. Note: RIPEMD, an ancestor of RIPEMD-128, is broken like MD5 is, and must not be used.
• A more conservative choice would be the-first-128-bits-of-SHA-256, if you relax the "with a name" and performance constraints just a tad. An attack against that would be considered an attack of SHA-256, which stands unbroken by March 2017 despite considerable efforts and attacks of reduced variants. The best known attack against the-first-128-bits-of-SHA-256 is a collision search (see start of this answer).

MD5 has often been used for protection of login information including password, or generation of a key from a password. In such applications, using any fast hash is a bad design choice, and you want to use proper key stretching. I have previously recommended scrypt when constraints allow (that is: there is ample memory; an efficient implementation of Salsa-20 is possible; and an appropriately secure implementation of SHA-256 is possible, which might be difficult if DPA is a consideration); or bcrypt, if scrypt is not an option; with some PBKDF2 and ample iteration parameter if all else is infeasible. Now we have Argon2, which should take over these.

• Of course it really depends on what you mean by "standard" hash function; but some of the SHA-3 candidates offer extension for a 160-bit output size (e.g. Shabal) and, being SHA-3 candidates, they have reasonably clear specifications with test vectors and sample implementations. Oct 12 '12 at 22:08
• Just as the selected hash function from the SHA-3 competition, Keccack, allows variable output lengths in addition to the required output sizes from the NIST.
– bob
Oct 13 '12 at 8:32
• As of September, RIPEMD-128 is now considered broken, and RIPEMD-160 is on a shorter leash Nov 1 '13 at 8:45
• @RichieFrame do you have a source for that?
– mat
May 15 '17 at 8:38
• @Richie Frame: if you have been referring to Franck Landelle and Thomas Peyrin's Cryptanalysis of Full RIPEMD-128 now discussed in my post, my understanding is that it yields collisions for different inputs of the round function slightly better than brute force, but not for different messages, thus does not break RIPEMD-128 as a hash, even theoretically.
– fgrieu
May 15 '17 at 13:24

One of the SHA2 or SHA 3 hashes; if you don't have any preference between them, pick SHA256.

You might hear the argument that the 256 bit version of SHA-3 is "newer", hence ought to be preferred. IMHO, older secure cryptography (that is, cryptography that has survived cryptanalysis longer) is generally to be preferred; however there appears to be nothing wrong with SHA-3.

What about SHA-3, which uses a sponge construction instead of Merkle-Damgård construction, which implies resistance to length extension attacks, unlike SHA-256 and SHA-512.

• AFAIK SHA-3 isn't specified yet, if you want to use it now you need to use a Keccak variant that'll be slightly different from the final SHA-3. So I recommend waiting until the SHA-3 standard is actually published. Jul 5 '13 at 6:28
• I know that, the SHS hasn't been updated yet. But I expect it to be updated maybe end of 2013 or start of 2014. Jul 6 '13 at 22:59