Weak hash (ARCH4111)
Key java.security.weak-hash · Severity error · Category security · CWE CWE-328
MD5 and SHA-1 are cryptographically broken; they are vulnerable to collision attacks and are not safe for security purposes like signatures, integrity, or passwords.
Incorrect
Section titled “Incorrect”MessageDigest md = MessageDigest.getInstance("MD5");byte[] digest = md.digest(data);Correct
Section titled “Correct”MessageDigest md = MessageDigest.getInstance("SHA-256");byte[] digest = md.digest(data);Use SHA-256 or a stronger algorithm for security hashing; avoid MD5 and SHA-1.