[
https://issues.apache.org/jira/browse/HBASE-30158?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18080534#comment-18080534
]
Balazs Meszaros commented on HBASE-30158:
-----------------------------------------
Mob file name generation also utilizes MD5, it is not clear at the moment if it
can be exploited or not.
> Reduce MD5 usage across the codebase
> ------------------------------------
>
> Key: HBASE-30158
> URL: https://issues.apache.org/jira/browse/HBASE-30158
> Project: HBase
> Issue Type: New Feature
> Reporter: Balazs Meszaros
> Priority: Major
>
> To maintain {*}FIPS 140-3 compliance{*}, the use of insecure hash algorithms
> like SHA-1 and MD5 is strictly prohibited for cryptographic purposes. While
> these algorithms remain permissible for non-security functions, robust
> collision handling is essential.
> We have identified specific scenarios where HBase fails to adequately handle
> collisions, which could be exploited using tools such as
> [fastcoll|https://github.com/brimstone/fastcoll].
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
