> both against 'bit rot' MD5 is good enough if bit rot alone is the only thing you care about. It's still very hard to generate an MD5 collision with the same

> both against 'bit rot' MD5 is good enough if bit rot alone is the only thing you care about. It's still very hard to generate an MD5 collision with the same bit length, and doing so would generally require changing a VERY large number of bits to get a collision, which is not what happens with bit rot. It might even be mathematically impossible to find two files that have the same MD5 hash and differ by less than a certain amount of bytes, though I don't know the proper way to formalize this. (It's trivial to show for example that if you use any CRC as a hash, it is impossible to find a collision that differs by an edit distance of 1 and has the same length.) > but also deliberate tampering. You're never safe from this if you aren't the guardian of the official hash values. Someone could just change the file AND change the "official" hashes.