The use of a non-standard algorithm is dangerous because a determined attacker may be able to break the algorithm and compromise whatever data has been protected. Standard algorithms like `SHA-256`, `SHA-384`, `SHA-512`, …​ should be used instead.

This rule tracks creation of `java.security.MessageDigest` subclasses.

## Recommended Secure Coding Practices

- Use a standard algorithm instead of creating a custom one.

## Sensitive Code Example

    public class MyCryptographicAlgorithm extends MessageDigest {
      ...
    }

## Compliant Solution

    MessageDigest digest = MessageDigest.getInstance("SHA-256");

## See

- OWASP - Top 10 2021 Category A2 - Cryptographic Failures
- OWASP - Top 10 2017 Category A3 - Sensitive Data Exposure
- CWE - CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
- Derived from FindSecBugs rule MessageDigest is Custom