What is the recommended replacement for MD5?

Question

Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?

Answer 1

That depends on what you want to use the hash function for.

For signing documents, sha2 (e. g. sha512) is considered secure.

For storing passwords, you should use one of the algorithms dedicated for this purpose: e. g. bcrypt, sha512crypt or scrypt. In order to slow down an attacker, these algorithms apply the hash functions many times with an input that is based on the number of the current round.

Scrypt takes this concept one step further and uses a huge amount of memory. Typical hardware for password cracking has access to about a couple of KB of memory, the default configuration of scrypt requires 16 MB.

Answer 2

Among the options for a replacement of MD5 as a hash function:

• If at all possible, you should increase the width of the hash for strong collision resistance, and use an at-least-256 bit member of the SHA-2, or perhaps the new SHA-3 family. The collision resistance of any 128-bit hash can be broken by educated brute force and about $2^{65}$ hashes (which is feasible for decently fast hashes and modern means) using Paul C. van Oorschot and Michael J. Wiener's Parallel Collision Search with Cryptanalytic Applications (in Journal of Cryptology, January 1999, Volume 12, Issue 1; free slightly earlier version available from the first author's website).
• If a 128-bit replacement is thought despite the above (which would be rational in applications where collision resistance is not an issue, and perhaps in HMAC)
  • a candidate worth examination is RIPEMD-128, a pin-compatible replacement of MD5, with a name. RIPEMD-128 uses the same security argument as RIPEMD-160 (though with 4 groups of rounds instead of 5). RIPEMD-160 in turn is AFAIK the single standard unbroken 160-bit hash, and has enjoyed the status of being vetted by European cryptographic authorities before the ban of all hashes less than 256-bit. RIPEMD-128 has been threatened in late 2013, by an attack (theoretically) finding collision on the round function for different chaining variable inputs with about 5 times less work than brute force. However RIPEMD128 should not be considered broken (as stated in this comment), because the attack does not yield a hash collision for different messages, and was not extended to that (as far as I can tell as of early 2017). But as the saying goes, attacks only get better; they never get worse.
    Despite that partial attack, when moderate resistance to collision is enough, RIPEMD-128 would remain a better choice than MD5, if the objective of the change was to remove the word MD5 from the specification, without changing anything else, nor loosing too much speed or requiring much more memory. Note: RIPEMD, an ancestor of RIPEMD-128, is broken like MD5 is, and must not be used.
  • A more conservative choice would be the-first-128-bits-of-SHA-256, if you relax the "with a name" and performance constraints just a tad. An attack against that would be considered an attack of SHA-256, which stands unbroken by March 2017 despite considerable efforts and attacks of reduced variants. The best known attack against the-first-128-bits-of-SHA-256 is a collision search (see start of this answer).

MD5 has often been used for protection of login information including password, or generation of a key from a password. In such applications, using any fast hash is a bad design choice, and you want to use proper key stretching. I have previously recommended scrypt when constraints allow (that is: there is ample memory; an efficient implementation of Salsa-20 is possible; and an appropriately secure implementation of SHA-256 is possible, which might be difficult if DPA is a consideration); or bcrypt, if scrypt is not an option; with some PBKDF2 and ample iteration parameter if all else is infeasible. Now we have Argon2, which should take over these.

Answer 3

One of the SHA2 or SHA 3 hashes; if you don't have any preference between them, pick SHA256.

You might hear the argument that the 256 bit version of SHA-3 is "newer", hence ought to be preferred. IMHO, older secure cryptography (that is, cryptography that has survived cryptanalysis longer) is generally to be preferred; however there appears to be nothing wrong with SHA-3.

Answer 4

What about SHA-3, which uses a sponge construction instead of Merkle-Damgård construction, which implies resistance to length extension attacks, unlike SHA-256 and SHA-512.