Why are MD5 checksum used for package verification

[alphaDev23]

Given that there are hashing algos less susceptible to collisions than MD5 (https://www.kb.cert.org/vuls/id/836068) and that Wazuh is software cantered around security, why are MD5 checksums used to verify packages (https://documentation.wazuh.com/current/installation-guide/packages-list/index.html#packages)?

[jesusgn90]

Hello @alphaDev23 ,

You are right, we must review our hash verification in order to use a more "best practices" algorithm. From my view the best would be SHA-2, right? What do you think about it? let us know and thanks!

Regards,
Jesús

[alphaDev23]

SHA-256 is the checksum algo used by OSSEC (https://www.ossec.net/downloads.html) for users to verify downloads.

[jesusgn90]

We note down your advice, thanks @alphaDev23 .

Regards,
Jesús

[jesusgn90]

Ok @alphaDev23 , finally we are going to use SHA-512 for all our packages. Closing this issue. Further releases will come with SHA-512, thanks @alphaDev23 !

[alphaDev23]

Thank you for considering the recommendation and making the change.

[jesusgn90]

You are welcome @alphaDev23