SHA512, SHA256, SHA1, and MD5 are vulnerable to a length extension attack. SHA224 and SHA384 are not since reduced output to internal state, SHA3 is also not vulnerable. Having that in mind, SHA512 is a good cryptographic collision-resistant hash function.
First things first: speed is overrated. You should make measures before declaring that a given algorithm is “too slow”. Most of the time, hash function speed makes no noticeable difference anyway. If you have qualms about security, then first select a hash function which is secure enough, and then only worry about performance. Moreover, you … Read more
Use the Linux Command Line Use the command line, as described in this related question: How do I check if my SSL Certificate is SHA1 or SHA2 on the commandline. Command Here’s the command. Replace www.yoursite.com:443 to fit your needs. Default SSL port is 443: openssl s_client -connect www.yoursite.com:443 < /dev/null 2>/dev/null \ | openssl … Read more
Yes, MD5 is somewhat less CPU-intensive. On my Intel x86 (Core2 Quad Q6600, 2.4 GHz, using one core), I get this in 32-bit mode: MD5 411 SHA-1 218 SHA-256 118 SHA-512 46 and this in 64-bit mode: MD5 407 SHA-1 312 SHA-256 148 SHA-512 189 Figures are in megabytes per second, for a “long” message … Read more
On https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest I found this snippet that uses internal js module: async function sha256(message) { // encode as UTF-8 const msgBuffer = new TextEncoder().encode(message); // hash the message const hashBuffer = await crypto.subtle.digest(‘SHA-256’, msgBuffer); // convert ArrayBuffer to Array const hashArray = Array.from(new Uint8Array(hashBuffer)); // convert bytes to hex string const hashHex = hashArray.map(b => … Read more