What hashing algorithm should I use?

Question

The PHP function hash_algos() gives me this list on my webserver:

[0] => md2
[1] => md4
[2] => md5
[3] => sha1
[4] => sha256
[5] => sha384
[6] => sha512
[7] => ripemd128
[8] => ripemd160
[9] => ripemd256
[10] => ripemd320
[11] => whirlpool
[12] => tiger128,3
[13] => tiger160,3
[14] => tiger192,3
[15] => tiger128,4
[16] => tiger160,4
[17] => tiger192,4
[18] => snefru
[19] => gost
[20] => adler32
[21] => crc32
[22] => crc32b
[23] => haval128,3
[24] => haval160,3
[25] => haval192,3
[26] => haval224,3
[27] => haval256,3
[28] => haval128,4
[29] => haval160,4
[30] => haval192,4
[31] => haval224,4
[32] => haval256,4
[33] => haval128,5
[34] => haval160,5
[35] => haval192,5
[36] => haval224,5
[37] => haval256,5

Which ones should I use for what and why? Especially, which one should I use for password hashing?

Answer 1

Both md5 and sha1 are decent for password hashing. Unfortunately, they are still vulnerable to a dedicated attacker with rainbow tables, but a minimum password length requirement will alleviate that issue.

Answer 2

While MD5 is not the strongest (i.e., least prone to collisions) it's probably your best bet as it seems to be the most common, so you'll have an easier time of things if you ever need to use external authenticators. (For example, using your existing user/pass table to authenticate users for services besides your app.)

Answer 3

SHA256 or SHA384 for password hashing. I've heard that some US organisations' policies disallow software components using SHA with higher bit length, but that depends.

Avoid MDx for hashing secure things like passwords if you can use SHA. See Is MD5 really that bad?

CRCxx is for checksums, they're bad for hashes as their value range is much smaller.

The others, I don't know about their use-cases.

Answer 4

The answer is you should not use any of the above hashing algorithms directly. Since you are using PHP, you may consider phpass (used by WordPress, Drupal 7) http://www.openwall.com/phpass/.

There are many discussions in the PHP communities on this topic, so don't re-invent security.

1. http://drupal.org/node/29706
2. http://core.trac.wordpress.org/ticket/2394,