How are SHA1 and MD5 considered to not protect against collisions?

Question

SHA1 and MD5 hash functions are considered to not protect against collisions while SHA2 is. Is it the size of the message digest that makes this or the algorithm itself? If it is based on the message digest why did it take longer for the MD5 to be proven that it does not protect against collisions than SHA1 given that SHA1 has a bigger message digest?

It also has been shown by Christophe De Cannière and Christian Rechberger in "Finding SHA-1 Characteristics: General Results and Applications" where a 64-round SHA-1 was presented, found using unoptimized methods with 2^35 compression function evaluations. It still needs to proceed to the full 80 round of SHA1 to be complete but it still proves that collisions are really really possible.

So more or less what creates the collisions? Is it only the message digest? What is the reason in choosing MD5 over SHA1?

I hope I am not asking too many questions in one

Answer 1

The Algorithms are broken : We can manually generate false certificates given only the md5 signature, for instance.

Many weaknesses have been found is SHA-1 to this day, but as far as I know, you can't yet generate a false certificate matching a SHA-1 hash. However, it is being considered obsolete, security experts think this weakness may soon come, and are banishing SHA-1-signed certificates by 2016

Also, optimizing SHA-1 calculation is not cool : it eases bruteforcing a SHA-1 hash. As I found on the internet some time ago, "Hash algorithms are like sex : Faster is not better"