Official CMS's of Government gazettes (in the third world), need to publish the checksum of each article and each cited external documentin (eg. full-text contracts) in a permanent support medium like paper, CD, DVD, etc. And, this is valid as legal proof for decades...
But the checksum is not valid for decades, and the CPU-cost to compute a checksum in this context is not the first problem... So, the question is
how to improve standard checksums, with minimal impact on the existing workflow?
Examples:
(so alternative question is "what is the best?" or "why not?")
use the truncated form of "the best of the best" (ex. truncated SHA256 instead SHA1).
use two checksums instead of only "the best of the best" (ex. SHA1+MD5).
use two checksums, the second after some "file conversion", such as gzip, imagemagick (eg. png2jpg), some pandoc (eg. pdf2text), that preserves main content.
CONTEXT AND EXPLANATIONS
The SHA1 is a cryptographic hash that has been used as checksum with aims of integrity and authenticity... So, the context of the question is this tradition of use cryptographic checksums for authenticity comprovations, there are no alternatives for a tradition, please not insist :-)
Let's give the name "authenticity-checksum" to this tradition and the methodologies it uses.
The theme gained more appeal last week with the first practical attack, with the discovery of an algorithm that can build a PDF document with the same SHA1 of other distinct PDF... You can check by yourself in a Linux terminal:
wget -c https://shattered.io/static/shattered-1.pdf
wget -c https://shattered.io/static/shattered-2.pdf
# open each file with your PDF-viewer, see how much distinct they are.
sha1sum shattered-1.pdf shattered-2.pdf
# 38762cf7f55934b34d179ae6a4c80cadccbb7f0a shattered-1.pdf
# ...
# look at your terminal! the same SHA1 for both files!
The SHA1 was published as a standard by NIST in 1995, gaining popularity and intensive in the 2000s. The first real and published attack was last week, 2017 (when standard was 22 years old). The first published "attack in theory" demonstration was in 2005, so 10 years after launch.
MD5, its precedent, published as RFC in 1992, with theoretical demonstration in 2008 and real attack in 2012.. It has had a similar timeline in its life-cycle.
We can use the standard's timilines as good time-scale reference, decades, and the historic facts (and Moore's law) as clue that SHA256 will survive less than a decade.
... So, about the use of authenticity-checksum in important digital repositories and digital preservation with horizon of decades context.
Imagine a CD-ROM with a big list of file-names and its checksums, a CD recorded in the year 2004, when we still believed in the durability of SHA1. For this "Use Case in the past",
what the best practices, what can we suggest to improve?
(is impossible to test hypothesis with the new standards, as SHA256, but we can in an imaginary use cases, testing the old standards, truncated hashes, and extrapolating results)