Cryptographic hash algorithms such as `MD2`, `MD4`, `MD5`, `MD6`, `HAVAL-128`, `HMAC-MD5`, `DSA` (which uses `SHA-1`), `RIPEMD`, `RIPEMD-128`, `RIPEMD-160`, `HMACRIPEMD160` and `SHA-1` are no longer considered secure, because it is possible to have `collisions` (little computational effort is enough to find two or more different inputs that produce the same hash).

## Ask Yourself Whether

The hashed value is used in a security context like:

- User-password storage.
- Security token generation (used to confirm e-mail when registering on a website, reset password, etc …​).
- To compute some message integrity.

There is a risk if you answered yes to any of those questions.

## Recommended Secure Coding Practices

Safer alternatives, such as `SHA-256`, `SHA-512`, `SHA-3` are recommended, and for password hashing, it’s even better to use algorithms that do not compute too "quickly", like `bcrypt`, `scrypt`, `argon2` or `pbkdf2` because it slows down `brute force attacks`.

## Sensitive Code Example

    Imports System.Security.Cryptography

    Sub ComputeHash()

        ' Review all instantiations of classes that inherit from HashAlgorithm, for example:
        Dim hashAlgo As HashAlgorithm = HashAlgorithm.Create() ' Sensitive
        Dim hashAlgo2 As HashAlgorithm = HashAlgorithm.Create("SHA1") ' Sensitive
        Dim sha As SHA1 = New SHA1CryptoServiceProvider() ' Sensitive
        Dim md5 As MD5 = New MD5CryptoServiceProvider() ' Sensitive

        ' ...
    End Sub

    Class MyHashAlgorithm
        Inherits HashAlgorithm ' Sensitive

        ' ...
    End Class

## Compliant Solution

    Imports System.Security.Cryptography

    Sub ComputeHash()
        Dim sha256 = New SHA256CryptoServiceProvider() ' Compliant
        Dim sha384 = New SHA384CryptoServiceProvider() ' Compliant
        Dim sha512 = New SHA512CryptoServiceProvider() ' Compliant

        ' ...
    End Sub

## See

- OWASP - Top 10 2021 Category A2 - Cryptographic Failures
- OWASP - Top 10 2017 Category A3 - Sensitive Data Exposure
- OWASP - Top 10 2017 Category A6 - Security Misconfiguration
- OWASP - Mobile AppSec Verification Standard - Cryptography Requirements
- OWASP - Mobile Top 10 2016 Category M5 - Insufficient Cryptography
- CWE - CWE-1240 - Use of a Risky Cryptographic Primitive