Earlier quoted context omitted.
> can we finally stop using MD5 While this is no reason not to use something else, I would also use newer & safer hash functions by default, MD5 is still perfectly fine for protecting against accidental corruption in storage or transit. Just don't use it if your protection model needs to consider deliberate changes. If you want to be extra paranoid, IIRC SHA256 outputs the full state so some types of length extension…
> IIRC SHA256 outputs the full state so some types of length extension attack are still possible (though massively less _practical_ than against MD5) I'm not aware of any differences between the length extension attack on MD5 and the one on SHA-256. As far as I know, it works the same way on both. Here's an assignment I did on the SHA-256 version if you want a deep dive: https://github.com/oconnor663/applied_crypto_2…
At least it is a polite exchange of thoughts. Far worse happens all the time.