Weak hash algorithm (ARCH308)

Ce contenu n’est pas encore disponible dans votre langue.

Key dotnet.security.weak-hash · Severity warning · Category security · CWE CWE-328

MD5 and SHA-1 are broken against collisions and must not be used for security. Use a modern hash family.

Incorrect

using var md5 = MD5.Create();
var hash = md5.ComputeHash(data);

using var sha = SHA256.Create();
var hash = sha.ComputeHash(data);

Replace MD5/SHA-1 with SHA-256 or stronger; for passwords use a KDF such as PBKDF2/bcrypt/Argon2.