For storing passwords no fast hash function which include md5 and SHA1/2 (even when salted) is acceptable. You need to use a slow hash, typically in the form of a Key-Derivation-Function to slow down brute-force. PBKDF2 and bcrypt are popular choices. You should also use a random per user salt.
But MD5 is considered "broken" by security professionals. It depends on exactly what your requirements are: MD5 might be suitable, but more secure hashes like the SHA-2 family would probably be a wiser choice, or even key-strengthening techniques such as PBKDF2 (as CodeInChaos suggests).
Note that your choice of hash algorithm alone can't be considered either secure or insecure in isolation. It's important to use the hash algorithm in a proven, tried-and-tested way.
Whether MD5 is safe to use depends on what you use it for, and how.
For message integrity, MD5 is not suitable any more because there exists an attack for finding an alternate message with the same hash.
For storing passwords in a database, MD5 is acceptable, supposed you salt it properly. For this usage, the known attack is entirely unimportant. If you are in paranoia mode, you can use a more complicated scheme like bcrypt too, but for most people, storing a salted password is just good enough. It prevents the easiest, most obvious attack, is easy to implement, hard to do wrong, and has low overhead.
Note that two different passwords having the same hash value is not really a problem under normal conditions. This happens, so what.
Having said that, using SHA instead of MD5 does not really cost anything extra. It has more bits, no known attack, and is supported by every half decent library.
发布评论
评论（3）
对于存储密码，不可接受包含 md5 和 SHA1/2（即使加盐）的快速哈希函数。您需要使用慢速哈希（通常采用密钥派生函数的形式）来减慢暴力破解速度。 PBKDF2 和 bcrypt 是流行的选择。您还应该为每个用户使用随机盐。
For storing passwords no fast hash function which include md5 and SHA1/2 (even when salted) is acceptable. You need to use a slow hash, typically in the form of a Key-Derivation-Function to slow down brute-force. PBKDF2 and bcrypt are popular choices. You should also use a random per user salt.
这些确实是合理的担忧。您可能会对以下文章感兴趣：
但 MD5 被安全专业人士视为“已损坏”。这完全取决于您的要求：MD5 可能合适，但更安全的哈希值，例如 SHA-2 系列 可能是一个更明智的选择，甚至是密钥强化技术，例如 PBKDF2（如 CodeInChaos 建议）。
请注意，单独选择哈希算法不能被视为安全或不安全。以经过验证、尝试和测试的方式使用哈希算法非常重要。
These are indeed legitimate concerns. You might find the following articles interesting:
But MD5 is considered "broken" by security professionals. It depends on exactly what your requirements are: MD5 might be suitable, but more secure hashes like the SHA-2 family would probably be a wiser choice, or even key-strengthening techniques such as PBKDF2 (as CodeInChaos suggests).
Note that your choice of hash algorithm alone can't be considered either secure or insecure in isolation. It's important to use the hash algorithm in a proven, tried-and-tested way.
MD5 使用是否安全取决于您使用它的目的和方式。
对于消息完整性，MD5 不再适合，因为存在寻找具有相同散列的备用消息的攻击。
对于在数据库中存储密码，MD5 是可接受的，假设您salt 正确地。对于这种用法，已知的攻击完全不重要。
如果您处于偏执模式，您也可以使用更复杂的方案，例如 bcrypt，但对于大多数人来说，存储加盐密码就足够了。它可以防止最简单、最明显的攻击，易于实施，不易出错，并且开销较低。
请注意，在正常情况下，具有相同哈希值的两个不同密码并不是真正的问题。发生这种事，那又怎样。
话虽如此，使用 SHA 代替 MD5 并不会产生任何额外费用。它有更多的位，没有已知的攻击，并且得到每一个像样的库的支持。
Whether MD5 is safe to use depends on what you use it for, and how.
For message integrity, MD5 is not suitable any more because there exists an attack for finding an alternate message with the same hash.
For storing passwords in a database, MD5 is acceptable, supposed you salt it properly. For this usage, the known attack is entirely unimportant.
If you are in paranoia mode, you can use a more complicated scheme like bcrypt too, but for most people, storing a salted password is just good enough. It prevents the easiest, most obvious attack, is easy to implement, hard to do wrong, and has low overhead.
Note that two different passwords having the same hash value is not really a problem under normal conditions. This happens, so what.
Having said that, using SHA instead of MD5 does not really cost anything extra. It has more bits, no known attack, and is supported by every half decent library.