Was wondering if there would be a possibility in replacing MD5 in NamingHelper.java with something that would be FIPS compliant? Having a look at the function itself it doesn’t seem to be using MD5 for anything cryptographic that could be considered as insecure but having said that having it there …

The hashing algorithm is only used to create consistent fk/constraint identifiers that are compatible with all supported databases, and is in no way involved with any security concern. At the moment there’s no way of choosing a different algorithm, and changing the default one would break compatibil…

Thanks for the quick reply. Completely agree that hibernate’s use case isn’t a security risk in itself, but in an ideal world would have like to strip it out from the jdk completely in case other 3rd party libs have less innocent uses for it and to prevent them from being brought in accidentally …

is the same method then used to later retrieve those names Yes, imagine a production environment where the fk/constraint names are constant. Hibernate sometimes needs to identify said constraints, so we need to have consistent names. If so wouldn’t defining a custom naming strategy result in th…

Ah makes sense, appreciate the explanation and your patience. I understand that the suggestion of custom naming strategy was for my application only and would leave the rest of the world safe. I was just trying to figure out if it would break our existing apps that already run in environments where …

@mbladel We are using hibernate 5.6 and in the same situation as the original poster. Our stack trace is a bit different: Caused by: java.security.NoSuchAlgorithmException: MD5 MessageDigest not available at sun.security.jca.GetInstance.getInstance(GetInstance.java:159) ~[?:?] at java.secur…

We are hitting the MD5 here: hibernate-core/src/main/java/org/hibernate/mapping/Constraint.java 5.6 * (full alphanumeric), guaranteeing * that the length of the name will always be smaller than the 30 * character identifier restriction…

MD5 hashing algo replacement question

Hibernate ORM

beikov March 4, 2025, 11:17am 8

If you are a Red Hat customer, you can try to create a support ticket for this matter. Otherwise, I have to refer you to the Maintenance Policy - Hibernate and the note on the release page: 5.6 series - Hibernate ORM

Topic		Replies	Views
Hibernate 5.2.14 ddl update tries to recreate tables in Oracle Hibernate ORM	10	7374	June 12, 2018
Missing auto generated constraint names on h2 ddl Hibernate ORM	1	220	April 5, 2024
Always Encrypt with Hibernate Hibernate ORM	19	6038	November 18, 2019
Hibernate to initialize a table and use a String as ID and Primary Key (a hash value that I supply)? Hibernate ORM	7	7350	May 3, 2018
org.hibernate.AnnotationException: Unable to create unique key constraint while making more than one column Hibernate ORM	1	3810	December 4, 2019

MD5 hashing algo replacement question

Related topics