Usage of weak hashing algorithm RB-S1002

Avoid usage of weak cryptographic keys like MD5, SHA1 and HMAC.

MD5 and SHA-1 are considered insecure because they have been shown to be vulnerable to collision attacks, which means that it is possible to create different input data that result in the same hash output. This vulnerability undermines the integrity of the hash function, as it can be exploited to generate fraudulent data that appears to have been verified as authentic using the hash function.

HMAC hashes, on the other hand, are not inherently insecure. However, their security can be compromised if they are implemented incorrectly or if the underlying hash function is vulnerable to collision attacks. Additionally, HMAC hashes can be vulnerable to key-based attacks if the key is weak or easily guessable.

As a result, it is generally recommended to use more secure hash functions, such as SHA-256 or SHA-3, and to employ additional security measures, such as salting and key stretching, to enhance the security of the hash.

Bad practice

require 'digest'

Digest::MD5.new
Digest::SHA1.hexdigest.new 'abc'

Recommended

require 'digest'

Digest::SHA2.hexdigest 'abc'
Digest::SHA2.new(384).hexdigest 'abc'
Digest::SHA384.hexdigest 'abc'

References

1. OWASP A02:2021: Cryptographic Failures
2. Collision attack
3. Adding Salt to Hashing: A better way to store passwords
4. Key Stretching