What hashing algorithm should I use? [duplicate]

This question a开发者_JS百科lready has answers here: Which hash algorithm is most secure for passwords? [closed] (2 answers) Closed 8 years ago.

The PHP function hash_algos() gives me this list on my webserver:

[0] => md2
[1] => md4
[2] => md5
[3] => sha1
[4] => sha256
[5] => sha384
[6] => sha512
[7] => ripemd128
[8] => ripemd160
[9] => ripemd256
[10] => ripemd320
[11] => whirlpool
[12] => tiger128,3
[13] => tiger160,3
[14] => tiger192,3
[15] => tiger128,4
[16] => tiger160,4
[17] => tiger192,4
[18] => snefru
[19] => gost
[20] => adler32
[21] => crc32
[22] => crc32b
[23] => haval128,3
[24] => haval160,3
[25] => haval192,3
[26] => haval224,3
[27] => haval256,3
[28] => haval128,4
[29] => haval160,4
[30] => haval192,4
[31] => haval224,4
[32] => haval256,4
[33] => haval128,5
[34] => haval160,5
[35] => haval192,5
[36] => haval224,5
[37] => haval256,5

Which ones should I use for what and why? Especially, which one should I use for password hashing?

---

The answer is you should not use any of the above hashing algorithms directly. Since you are using PHP, you may consider phpass (used by WordPress, Drupal 7) http://www.openwall.com/phpass/.

There are many discussions in the PHP communities on this topic, so don't re-invent security.

1. http://drupal.org/node/29706
2. http://core.trac.wordpress.org/ticket/2394,

---

SHA256 or SHA384 for password hashing. I've heard that some US organisations' policies disallow software components using SHA with higher bit length, but that depends.

Avoid MDx for hashing secure things like passwords if you can use SHA. See Is MD5 really that bad?

CRCxx is for checksums, they're bad for hashes as their value range is much smaller.

The others, I don't know about their use-cases.

---

Both md5 and sha1 are decent for password hashing. Unfortunately, they are still vulnerable to a dedicated attacker with rainbow tables, but a minimum password length requirement will alleviate that issue.