OK, I measured a dozen machines, and I found a very mixed picture using 'openssl speed'. - Lots of modern x86 machines with SHA-NI that were typically 50-300%

OK, I measured a dozen machines, and I found a very mixed picture using 'openssl speed'. - Lots of modern x86 machines with SHA-NI that were typically 50-300% faster than MD5 - Older Intel machines, where SHA1 was generally slightly faster, with one or two exceptions where the reverse was true. - ARM machines with good SIMD/NEON where the NEON implementation of SHA1 was 30-40% faster than MD5. - Embedded ARM machines with bad SIMD/NEON where it was pretty much a tie. - A few ARM machines-- most notably Broadcom chipsets in the Raspberry Pi, where MD5 wins big a large margin. - Embedded MIPS 24k, where MD5 won by 33%. Then I found http://bench.cr.yp.to/results-hash.html http://bench.cr.yp.to/results-hash.html , which bears out what I'd measured. In any case, I don't think "speed" is any reason to select MD5, unless maybe if you're on MIPS 24k.