Which hash algorithm should you choose
Eighteen algorithms in a dropdown are either a promise or an anxiety, depending on how much you know. The good news: they are not eighteen independent choices. They are three families with different internal constructions, plus two checksums that have nothing to do with cryptography and should never be confused with the rest.
Three families, not eighteen decisions
What truly separates one hash algorithm from another is not digest length: it is how it chews the data. And in production there are three ways of chewing.
The 18 algorithms in Probatio
| Algorithm | Bits | Family | When to use it |
|---|---|---|---|
| MD5 | 128 | Merkle–Damgård | Compatibility with E01, hash sets and historical records. Never alone on adversary-supplied files. |
| SHA-1 | 160 | Merkle–Damgård | Like MD5: interoperability, not primary assurance. |
| SHA-224 | 224 | SHA-2 | Rare. Truncated SHA-256, for space constraints. |
| SHA-256 | 256 | SHA-2 | The default. De facto standard of forensics and of BagIt. |
| SHA-384 | 384 | SHA-2 | When a specification mandates margins above 256 bits. |
| SHA-512 | 512 | SHA-2 | On 64-bit CPUs it is often faster than SHA-256. An excellent second hash. |
| SHA-512/224 | 224 | SHA-2 | Truncated SHA-512 with a different IV: immune to length extension. |
| SHA-512/256 | 256 | SHA-2 | 256 bits at SHA-512 speed. Underrated. |
| SHA3-224 | 224 | Sponge (Keccak) | Diversification away from SHA-2. |
| SHA3-256 | 256 | Sponge (Keccak) | The best companion to SHA-256: independent internal structure. |
| SHA3-384 | 384 | Sponge (Keccak) | High regulatory requirements. |
| SHA3-512 | 512 | Sponge (Keccak) | Maximum margin, higher cost. |
| RIPEMD-160 | 160 | Merkle–Damgård | Bitcoin ecosystem and older European PKIs. |
| BLAKE2b-512 | 512 | HAIFA | Fast on 64-bit CPUs, robust, used by BagIt. |
| BLAKE2s-256 | 256 | HAIFA | Variant for 32-bit architectures and embedded systems. |
| BLAKE3 | 256 | Merkle tree | Fastest on very large files: uses every core. |
| CRC32 | 32 | not cryptographic | Transmission errors. Forgeable in milliseconds. |
| XXH3 | 64 | not cryptographic | Deduplication and caching. Never as evidence. |
CRC32 and XXH3 are not cryptographic hashes
They belong in a separate box, and Probatio explicitly marks them as non-cryptographic. A CRC32 is designed to notice that a cable corrupted a few bits in transit. It is not designed to resist a human being who wants to fool it: given any CRC32, constructing a file that produces it is a linear-algebra exercise solved instantly.
A CRC32 presented in a technical report as an integrity guarantee is a mistake that gets noticed. It is fine for checking that a download did not corrupt. It is fine for nothing else.
How to choose
The cost of computing many: essentially zero
Intuition says six algorithms cost six times one. Wrong, and for a reason that has more to do with the disk than with mathematics.
Probatio reads the file once, in 1 MiB blocks, and hands each block to every selected algorithm before reading the next. On a spinning disk, or on a file of tens of gigabytes, time is dominated by reading: the CPU updates six internal states while waiting for the next block. In practice, computing MD5, SHA-1, SHA-256, SHA-512 and BLAKE3 together costs about as much as computing one.
Put differently: there is no reason to economise. Select the ones you need today, plus the one you will need when the case file is reopened.
Three recurring mistakes
- Believing more bits mean more security. SHA-512 is not «twice as secure» as SHA-256: today both are unbreakable. The extra margin buys longevity, not present-day resistance.
- Picking two algorithms from the same family. SHA-256 and SHA-384 share a construction: a structural attack on SHA-2 would touch both. SHA-256 and SHA3-256 would not.
- Putting a CRC32 in a report. See above.
Eighteen entries in a menu are not eighteen decisions: they are an archive. You will use two or three, always the same ones — but the day a 2009 E01 lands on your desk carrying nothing but an MD5, you will be glad the rest is there.