DeepSource
Dashboard Resources Pricing Discover Directory Log in

Run your first analysis.

Find thousands of code security and quality issues in your codebase, before they end up in production.

Start now
Java

Java

Made by DeepSource
Use Analyzer

Custom hashing algorithms must not be used JAVA-S1008

Security
Critical
 a02 a04 cwe-327 cwe-310 cwe-656 owasp top 10

Implementing a custom hashing algorithm can be error-prone and could allow for collision-based attacks on hashed data. Avoid implementing your own hash function, and use only trusted implementations.

NIST recommends the use of SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, or SHA-512/256 when data needs to be hashed.

Bad Practice

A custom hash function could have unforeseen vulnerabilities that reduce security and allow attackers to easily create collisions between hashed values.

MyProprietaryMessageDigest extends MessageDigest {
    @Override
    protected byte[] engineDigest() {
        //Creativity is a bad idea
        return [...];
    }
    ...
}

Recommended

Use an existing trusted hash algorithm that suits your security needs to generate hashes.

MessageDigest sha256Digest = MessageDigest.getInstance("SHA256");
sha256Digest.update(password.getBytes());

References