If I have the MD5 and SHA1 hash matches for an encrypted container. Is there no possibility it's been modified?

Is it safe to assume the container has never been modified?

  • In theory, possible but a very small possibility, e.g., 10^(-40). In practical, 100% for sure NEVER been modified, no human beings know how to modify without changing MD5/SHA1
    – TJCLK
    Dec 12 '19 at 10:46

It is never zero, there is always a probability that there are many files that have the same hash value due to the pigeonhole principle and almost uniform distribution of the output of the cryptographic hash functions. This can be understand by the arbitrary input size of the hash function but fixed output size, like MD5 has 128-bit and SHA-1 has 160-bit output sizes but they can hash every file.

The probability will be reduced if you use two different hashes or even more, however, you don't need that. Just use a hash like SHA3-512 or Blake2-512 that has higher resistances then when both MD5 and SHA-1 combined. If you want the longer output to decrease the probability of successful attacks you can use XOF like Shake.

You can also use HMAC-SHA3 so that you will have a keyed hash that also provides unforgeability. This will help in the case that if attackers can access the file and hash of it at the same time then they can replace it with a new file with the hash of it. Since HMAC requires a key, they can not execute this attack.

Note that neither MD5 nor SHA-1 is considered secure anymore. MD5 and SHA-1 has collisions attacks.


There is a very very very low mathematical probability that the container could be modified without changing both SHA1 and MD5. There are known collision attacks on both hashes, however one would need to produce an still valid ciphertext that can be decrypted and this would make it hard. I´m also not aware of an practical attack that produces a collision for both MD5 and SHA1 hashes at the same time. Therefore, I would say you are probably fine if you can make sure the hashes are the same, however I would also recomment just using at least a newer hash funcion (SHA2).

However, you don´t explain how you know that the hash is the right one. Where/how you obtained them? Hashes only provide integrity, but not authenticity. If the hashes could be provided by an attacker, anyone coud create or replace them.

You also mention the data is ciphered. Usually when you cipher something you also want it to be "signed". You should probably just be using, if it is possible, AES-GCM that is an authenticated cipher mode. That way you would have both authenticity, iintegrity and confidentiality assured.

If you can´t change the way you are just need to add authenticity and integrity check to an already ciphered data, you should probably use an HMAC. If the person that generates the data is another person, you could also us assymetric key signing of an hash or share the HMAC key using an assymetric protocol.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.