Chapter 9 — The real hash functions, and which are broken

The table to memorise

What "broken" actually means

The distinction matters, because "MD5 is broken" is often over- and under-stated.

   COLLISION ATTACK  -- find ANY two inputs with the same hash.
      MD5:   seconds on a laptop
      SHA-1: ~2^63 work; done for real in 2017 (SHAttered)
      -> breaks SIGNATURES and CERTIFICATES

   CHOSEN-PREFIX COLLISION -- find a collision where you control both prefixes.
      MD5:   trivial
      SHA-1: demonstrated in 2020, ~$45k of compute at the time
      -> breaks practically everything; this is what killed SHA-1 for good

   PREIMAGE ATTACK -- given a hash, find AN input producing it.
      MD5:   still not practical
      SHA-1: still not practical
      -> so "MD5 of a strong random value" isn't instantly broken...
         but there is no reason to use it, and plenty of ways it bites you

Bottom line: MD5 and SHA-1 fail exactly where hashes matter most — proving that a document, certificate, or binary is the one you think it is.

The real-world consequences

Flame malware (2012) forged a Microsoft code-signing certificate using an MD5 chosen-prefix collision. It let malware appear to be a legitimate Windows Update. That is the practical meaning of "collisions break signatures".

SHAttered (2017) — Google and CWI produced two different PDF files with the same SHA-1 hash. Immediately afterwards, SHA-1 was removed from certificate issuance, and git had to add collision detection.

Choosing in practice

   General-purpose hashing, integrity, signatures    -> SHA-256
   Need extra margin / long-term                     -> SHA-512 or SHA-3-256
   Performance-critical (lots of data)               -> BLAKE3
   Hashing PASSWORDS                                 -> NONE OF THESE (Chapter 10)
   Legacy system compatibility only                  -> document the risk, plan removal

Simplified: SHA-512 is often faster than SHA-256 on 64-bit CPUs, despite the bigger output. If you want margin and speed, SHA-512 (or its truncated variant SHA-512/256) is a good pick.

Length-extension: a subtlety that matters

SHA-1 and SHA-2 have a structural quirk: given hash(secret || message) and the length of secret, an attacker can compute hash(secret || message || extra) without knowing the secret.

   NAIVE (broken):   token = sha256(secret + data)
                     -> attacker appends "&admin=true" and forges a valid token

   CORRECT:          token = HMAC-SHA256(secret, data)      (Chapter 11)

SHA-3 and BLAKE2/3 are immune by design. But the right answer is always HMAC, not picking a different hash.

cd ~/sec-lab/scratch

# --- compare algorithms and their output sizes ---
for alg in md5 sha1 sha256 sha512 sha3-256; do
  printf "%-10s " "$alg"; printf 'hello' | openssl dgst -$alg 2>/dev/null | awk '{print $2}'
done

# --- speed comparison ---
openssl speed -evp sha256 2>/dev/null | tail -3
openssl speed -evp sha512 2>/dev/null | tail -3

# --- see a REAL MD5 collision ---
# Two different files, identical MD5. (Marc Stevens' classic example.)
curl -sO https://raw.githubusercontent.com/corkami/collisions/master/examples/free/md5_1.bin
curl -sO https://raw.githubusercontent.com/corkami/collisions/master/examples/free/md5_2.bin
cmp md5_1.bin md5_2.bin && echo "identical files" || echo "DIFFERENT files"
openssl dgst -md5 md5_1.bin md5_2.bin
openssl dgst -sha256 md5_1.bin md5_2.bin      # SHA-256 tells them apart