MD5 is a very fast hash and its output is short and easy to store. Should I use it for my non-security-sensitive application?
I don't think so, but I can't seem to convince anyone else that this is true.
$\begingroup$
$\endgroup$
5
-
$\begingroup$ Can you provide more details on the application? What do you need a hash function for? $\endgroup$– mikeazoCommented Jul 27, 2012 at 19:18
-
$\begingroup$ The other day I made the argument that md5 should be replaced with sha-256 in a particular application. I wanted to sign the file digests. I was stunned by the fervent opposition to what I thought was a completely innocuous change. So I am asking for advice about how to better explain the harmlessness of strong hashing to my peers. $\endgroup$– joeforkerCommented Jul 27, 2012 at 19:31
-
$\begingroup$ What are you using to sign the digests, PKI? $\endgroup$– mikeazoCommented Jul 27, 2012 at 19:59
-
$\begingroup$ @joeforker "and its output is easy to store" you do know you can truncate longer hashes, right? It has been discussed here before and it's generally considered to be a safe thing to do (provided you don't truncate too many bits). That leaves performance as the only plausible basis to use MD5... oh, hello SHA3! $\endgroup$– ThomasCommented Jul 28, 2012 at 4:01
-
$\begingroup$ @joeforker, since this question popped back up on my radar, I took another look at it. You say it is a non-security-sensitive application, but then you say you want to sign the file digests. Tell me if I have the application right. You have a file, you take the MD5 hash of it to compute the file's digest. You then sign that digest with an RSA key? If this is the case, then it is a scurity sensitive application and you should not use MD5. $\endgroup$– mikeazoCommented Oct 15, 2012 at 11:45
Add a comment
|
3 Answers
$\begingroup$
$\endgroup$
3
When I need to show to others that they are wrong and it is their word against mine, I look to the words of industry recognized experts and then challenge them to find an industry recognized expert that supports their belief.
In this case, Bruce Schneier has written a lot on MD5 (in Bruce style, each word links to a different blog post or article of his).
Wikipedia even has a nice article on MD5 security.
That said, you specify in your question that this is potentially for a "non-security-sensitive" application. What do you mean by that? Your comment seems to suggest that you are signing hashes of files. That to me seems security sensitive.
-
$\begingroup$ It used to be a non-security application. The plan was to re-use the file for signing. $\endgroup$ Commented Jul 27, 2012 at 20:17
-
2$\begingroup$ Is security now a component of the application? We need to understand where the lines in your application are being drawn between intended security and no intended security. $\endgroup$– B-ConCommented Jul 27, 2012 at 20:33
-
1$\begingroup$ The main reason not to use MD5 is that you will have to convince people that it is safe and that will not be easy. You are not the only one who will have a queasy feeling. $\endgroup$ Commented Jul 29, 2012 at 12:23
$\begingroup$
$\endgroup$
If I was developing a new application and could use any hash function, and my application is even a little tiny bit security sensitive, my default is (soon) SHA-3.
Last year, my default hash function for anything even a little tiny bit security sensitive was SHA-256. It's about half as fast as MD5.
MD5 and SHA-1 are adequate for some applications, so there's no real rush to update all the software that currently uses it for those applications. But I would use the above alternatives instead for any new application, because:
US-CERT says MD5 "should be considered cryptographically broken and unsuitable for further use." NIST says "Federal agencies should stop using SHA-1 for...applications that require collision resistance as soon as practical, and must use the SHA-2 family of hash functions for these applications after 2010"
If I was implementing a non-security-sensitive hash table I would default to using the "Jenkins One-at-a-time hash".
If I need a hash to use as a checksum detect accidental (i.e., not malicious) bit errors, and it needed to be faster than SHA-256, I would probably by default use a CRC-32 if there was a library implementation handy and I had plenty of program space. If I needed to implement some kind of checksum myself -- or if it needed to use very little program space -- I would by default write a Fletcher-32 checksum implementation.
answered Jul 28, 2012 at 5:26
$\begingroup$
$\endgroup$
The only threats against MD5 are security, afaik it's mostly about its collision resistance (and some specific cases of preimage).
If you rite that app is "non-security-sensitive", maybe you should not care about those threats and gain from speed?
For some applications collisions are acceptable when happen very rarely - let's take hash tables as example.
If you app has similar requirements as Hash table datastructure, go and check out if there is even better choice than md5! (for speed, parallelism or other reason)
