Skip to main content
Information Security

Return to Question

replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

I was just reading about SSL/TLS stuff, and according to this site (which is rated as A by Qualys SSL Labs), MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And yet, I noticed that a lot of programmers and even Microsoft only give us SHA-1/MD5 to check the integrity of files...

As far I know, if I change one bit of a file, their MD5/SHA-1 will change so why/how they are broken? In which situations can I still trust checksums made with SHA-1/MD5? What about SSL certificates that still use SHA-1 like google.com?

I am interested in applications of MD5 and SHA-1 for checksums and for certificate validation. I am not asking about password hashing, which has been treated in this questionhas been treated in this question.

I was just reading about SSL/TLS stuff, and according to this site (which is rated as A by Qualys SSL Labs), MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And yet, I noticed that a lot of programmers and even Microsoft only give us SHA-1/MD5 to check the integrity of files...

As far I know, if I change one bit of a file, their MD5/SHA-1 will change so why/how they are broken? In which situations can I still trust checksums made with SHA-1/MD5? What about SSL certificates that still use SHA-1 like google.com?

I am interested in applications of MD5 and SHA-1 for checksums and for certificate validation. I am not asking about password hashing, which has been treated in this question.

I was just reading about SSL/TLS stuff, and according to this site (which is rated as A by Qualys SSL Labs), MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And yet, I noticed that a lot of programmers and even Microsoft only give us SHA-1/MD5 to check the integrity of files...

As far I know, if I change one bit of a file, their MD5/SHA-1 will change so why/how they are broken? In which situations can I still trust checksums made with SHA-1/MD5? What about SSL certificates that still use SHA-1 like google.com?

I am interested in applications of MD5 and SHA-1 for checksums and for certificate validation. I am not asking about password hashing, which has been treated in this question.

Tweeted twitter.com/#!/StackSecurity/status/598386814404206592
Reformatting to English grammar and typography, formatting links, and transforming the edit/comment of OP into a rescoping of the question. Rewording the main question to call for more detailled rather than binary yes/no questions. OP: do change back if I've done anything wrong
Source Link
Steve Dodier-Lazaro
Steve Dodier-Lazaro
  • 6.9k
  • 31
  • 45

Why are MD5 and SHA-1 are still used for checksums and certificates if they are called broken?

I was just reading about SSL/TLS stuff when according to this site :, and https://fancynossl.hboeck.deaccording to this site which(which is rated as A by Qualys SSL Labs and they say that), MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And iyet, I noticed that a lot of programmers and even Microsoft only give us SHA-1/MD5 to check forthe integrity of files..why?.

So asAs far iI know, if iI change one bit of a file, their MD5/SHA-1 will change so why/how they are broken  ? Can iIn which situations can I still trust checksums made with SHA-1/MD5? AndWhat about SSL certificates that still use SHA-1 like google.com  ?

Edit : I don't think its a duplicate because the other question only explains whyam interested in applications of MD5 should not be used to store passwords, but my mainly concern here is about checksums and certificates(even reputable companies are still using shaSHA-1 on their certificates) i have only included MD5 on my question because is still the most used hash to check for integrity of fileschecksums and for certificate validation. I am not asking about password hashing, which has been treated in this question.

Why MD5 and SHA-1 are still used if they are called broken?

I was just reading about SSL/TLS stuff when according to this site : https://fancynossl.hboeck.de which is rated as A by Qualys SSL Labs and they say that MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And i noticed that a lot of programmers and even Microsoft only give us SHA-1/MD5 to check for integrity of files..why?

So as far i know, if i change one bit of a file their MD5/SHA-1 will change so why/how they are broken  ? Can i still trust checksums made with SHA-1/MD5? And about certificates that still use SHA-1 like google.com  ?

Edit : I don't think its a duplicate because the other question only explains why MD5 should not be used to store passwords, but my mainly concern here is about checksums and certificates(even reputable companies are still using sha-1 on their certificates) i have only included MD5 on my question because is still the most used hash to check for integrity of files

Why are MD5 and SHA-1 still used for checksums and certificates if they are called broken?

I was just reading about SSL/TLS stuff, and according to this site (which is rated as A by Qualys SSL Labs), MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And yet, I noticed that a lot of programmers and even Microsoft only give us SHA-1/MD5 to check the integrity of files...

As far I know, if I change one bit of a file, their MD5/SHA-1 will change so why/how they are broken? In which situations can I still trust checksums made with SHA-1/MD5? What about SSL certificates that still use SHA-1 like google.com?

I am interested in applications of MD5 and SHA-1 for checksums and for certificate validation. I am not asking about password hashing, which has been treated in this question.

added 369 characters in body
Source Link
Freedo
Freedo
  • 2.3k
  • 5
  • 20
  • 29

I was just reading about SSL/TLS stuff when according to this site : https://fancynossl.hboeck.de which is rated as A by Qualys SSL Labs and they say that MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And i noticed that a lot of programmers and even Microsoft only give us SHA-1/MD5 to check for integrity of files..why?

So as far i know, if i change one bit of a file their MD5/SHA-1 will change so why/how they are broken ? Can i still trust checksums made with SHA-1/MD5? And about certificates that still use SHA-1 like google.com ?

Edit : I don't think its a duplicate because the other question only explains why MD5 should not be used to store passwords, but my mainly concern here is about checksums and certificates(even reputable companies are still using sha-1 on their certificates) i have only included MD5 on my question because is still the most used hash to check for integrity of files

I was just reading about SSL/TLS stuff when according to this site : https://fancynossl.hboeck.de which is rated as A by Qualys SSL Labs and they say that MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And i noticed that a lot of programmers and even Microsoft only give us SHA-1/MD5 to check for integrity of files..why?

So as far i know, if i change one bit of a file their MD5/SHA-1 will change so why/how they are broken ? Can i still trust checksums made with SHA-1/MD5? And about certificates that still use SHA-1 like google.com ?

I was just reading about SSL/TLS stuff when according to this site : https://fancynossl.hboeck.de which is rated as A by Qualys SSL Labs and they say that MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And i noticed that a lot of programmers and even Microsoft only give us SHA-1/MD5 to check for integrity of files..why?

So as far i know, if i change one bit of a file their MD5/SHA-1 will change so why/how they are broken ? Can i still trust checksums made with SHA-1/MD5? And about certificates that still use SHA-1 like google.com ?

Edit : I don't think its a duplicate because the other question only explains why MD5 should not be used to store passwords, but my mainly concern here is about checksums and certificates(even reputable companies are still using sha-1 on their certificates) i have only included MD5 on my question because is still the most used hash to check for integrity of files

Source Link
Freedo
Freedo
  • 2.3k
  • 5
  • 20
  • 29