Simple question: Both MD5 and SHA1 are susceptible to a collision attack. It's reasonable to assume that SHA256, the next algorithm we're switching to, also has such an issue, but one that's hidden because of the requirements to find such a collision.

The thing is, why don't we use multiple algorithms to verify file integrity? like, calculate multiple checksums using multiple algorithms for the same file and only declare it acceptable if all of them match? I mean, finding a collision for MD5 right now is doable on smartphones, and finding one for SHA1 has been proven feasible with the SHAttered attack. however, if you had to find a collision for both MD5 AND SHA1, wouldn't that increase the time needed as well?

Clarification: While this particular suggestion may actually be in use in places, what I'm talking about is: why isn't this technique commonly proposed as an alternative to upgrading to SHA256?

  • do you have proof that it is not being used anywhere in the world?
    – Purefan
    Feb 24, 2017 at 15:37
  • You can do it, anyone can do it. You can even implement MD5SHA1 sum that concatenates both MD5 and SHA1.
    – ThoriumBR
    Feb 24, 2017 at 15:38
  • 1
    @Purefan sorry, I had to make myself clear. I clarified what I meant. I wasn't talking about "why aren't we using it in the wild?" but about "why isn't this suggested as an alternative to a stronger hashing function?"
    – Nzall
    Feb 24, 2017 at 15:41
  • 1
    The edit makes security.stackexchange.com/questions/83881/… relevant too
    – Matthew
    Feb 24, 2017 at 15:41

2 Answers 2


Using multiple hash functions is simply the same as defining a new hash function, only much slower than a "better" secure hash and with little justification for the design.

So while it might indeed be harder to find a collision in your ad-hoc H(x)=MD5(x)||SHA1(x) than finding a collision in the components, it is far less efficient and likely less secure than purpose-built functions like SHA2-512 or SHA3-512. Even SHA2-256 has shown no weakness in the last decade of cryptanalysis.


Applying chained hash functions into a plaintext does not necessarily makes something 'more secure'.

If we could answer whether applying MD5 to SHA1 (or the opposite) weakens the resulting hash (by reducing entropy, for example), then the recommendation would make sense.

  • I'm not talking about "chained hashes", I'm talking about "hash the original file with SHA1, hash the original file with MD5, only accept the file if both hashes match with what's being passed."
    – Nzall
    Mar 31, 2017 at 7:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .