Metadata

ID: swift-security/avoid-md5

Language: Unknown

Severity: Warning

Category: Security

Description

This rule flags the use of the MD5 hashing algorithm in Swift code. MD5 is considered cryptographically broken and unsuitable for further use due to its vulnerability to collision attacks, where two different inputs produce the same hash output. Using MD5 can compromise the security and integrity of data, especially in contexts like password hashing, digital signatures, or data verification.

To maintain strong security standards, developers should avoid MD5 and instead use more secure hashing algorithms such as SHA-256. These algorithms provide better resistance against collision and preimage attacks, ensuring the integrity and authenticity of hashed data. For example, replacing message.md5() with message.sha256() significantly improves security.

Non-Compliant Code Examples

let digest = message.md5();

Compliant Code Examples

let digest = message.sha256();