Weak Hash (ARCH5111)

Key go.security.weak-hash · Severity error · Category security · CWE CWE-328

MD5 and SHA-1 are cryptographically broken against collisions; using them for security purposes (signatures, integrity, fingerprints) opens the door to attacks.

Incorrect

func fingerprint(data []byte) string {
  sum := md5.Sum(data)
  return hex.EncodeToString(sum[:])
}

Correct

func fingerprint(data []byte) string {
  sum := sha256.Sum256(data)
  return hex.EncodeToString(sum[:])
}

Fix

Use SHA-256 or a stronger algorithm instead of MD5/SHA-1 for security-relevant hashing.