RIPEMD-160 would be a more appropriate hash for this. SHA-1 is no longer thought to be sufficiently secure against collisions.
Edit: If you're downvoting, please explain. This is more or less factually correct.
Edit: If you're downvoting, please explain. This is more or less factually correct.
"openssl speed" reports RIPEMD-160 being a few percent faster than SHA256 on my computer.
What makes you say it's "less resistant to collisions"? I don't think there are any serious cryptanalytical attacks on RIPEMD160.
RIPEMD has a 256-bit variant, but it hasn't received enough scrutiny.
We don't care about the likelihood of producing some random collision; we care about the likelihood of producing some specific collision (which is not vulnerable to the birthday attack). http://en.wikipedia.org/wiki/Preimage_attack
The reason SHA-1 is considered insufficient is that it is cryptographically broken https://marc-stevens.nl/research/papers/PhD%20Thesis%20Marc%...
I.e. the chance of finding a collision is substantially higher than would be expected from an ideal PRF.
As far as I know, there are no serious cryptanalytical attacks on RIPEMD-160, and 160 bits is more than sufficient for cryptographically unique identifiers.
- I publish a JavaScript library under this scheme using a hash without collision resistance.
- Popular/important websites refer to my library as hashname://..., trusting that this refers to the version of the library that they audited.
- I can then create a new, malicious version of the library that has the same hash and use it to infect popular sites.
Allowing collisions breaks the immutability requirement, which impacts security in many important cases.
All hashes have collisions. There are no cryptographic hashes that can promise zero collisions.
The reason SHA-1 is insecure is that it is cryptographically broken, and the same attack takes less than 2^60 attempts.