ASVS 5.0 V11.4.3 (Level 2) requires hash functions used in signatures, data authentication or integrity checks to be collision resistant with suitable length. If collision resistance matters, output must be at least 256 bits. If only second preimage resistance matters, 128 bits is enough.
Why it matters
Collisions let an attacker craft two different inputs with the same digest, which breaks signatures and file integrity checks. SHA-1 and MD5 collisions are practical.
How to implement it
Default to SHA-256, SHA-384, SHA-512 or SHA-3 for signatures and integrity. A truncated hash is fine only if the result stays above the bar for the property you need.
sum := sha256.Sum256(data)
For checksums published with releases, use SHA-256 and sign the checksum file.
How to test it
Grep for md5, sha1, SHA1withRSA and truncation calls. Inspect signing configs and certificate signature algorithms with openssl x509 -text.
Common mistakes
- Using SHA-1 for git style content addressing in a security role
- Truncating a digest to 64 bits for convenience
- Assuming a non security checksum cannot be abused
Quick check
Minimum output for collision resistance?
256 bits.
