MD5 and SHA-1 are well-known cryptographic hash functions. And HMAC is a well-known keyed hash-based message authentication code that involves a cryptographic hash function and a secret cryptographic key. Before we go to the topic of which one to use for HMAC, let’s first understand which one does what.

What are MD5, SHA-1, and HMAC?

MD5 is one in a series of message-digest algorithms designed by Prof. Ronald Rivest of MIT. It produces a 128-bit hash value, and the hash value is expressed in text format as a 32-digit hexadecimal number.

SHA is also a cryptographic hash algorithm designed by the United States National Security Agency. SHA produces a 160-bit hash value, and the hash value is expressed as a 40-digit hexadecimal number. SHA-1 is a member of the Secure Hash Algorithm (SHA) family. SHA-1 is similar to SHA-0 but alters the original SHA hash specification to correct some weaknesses. SHA-2 was published in 2001, and it is significantly different from SHA-1. In 2005, cryptoanalysts found attacks on SHA-1 and suggested that the algorithm might not be secure enough for ongoing use. Although no successful attacks have been …