EVP_SHA1(3)

💅 EVP_SHA1(3) — bestie, these are the legacy digest girlies

okay so this page lives in section 3 of the manual, and it's all about the legacy message digest algorithms — the ones from the libcrypto library (yes, that libcrypto, the OpenSSL-ish one). these are the OGs, the elders, the ones your crypto professor warns you about. 🫶

---

✨ NAME ✨

EVP_sha1, EVP_md5, EVP_md5_sha1, EVP_md4 — legacy message digest algorithms

---

🌸 SYNOPSIS 🌸

#include <openssl/evp.h>

const EVP_MD *
EVP_sha1(void);

const EVP_MD *
EVP_md5(void);

const EVP_MD *
EVP_md5_sha1(void);

const EVP_MD *
EVP_md4(void);

lowkey the library “libcrypto” bit is part of how you link it, so don't come for me — it's in the synopsis block above, exactly where it belongs. 💅

---

🦋 DESCRIPTION 🦋

Okay so real talk first, because this is the important part: the following message digest algorithms are cryptographically broken. Like, all of them. every single one. None of them should be used in new code unless there is no way around it. that's not me being dramatic, that's just the truth — no cap.

now let's meet the cast 🎀

• EVP_sha1() — implements the SHA-1 algorithm and produces 160 bits of output from a given input. still hanging around in places where there's literally no escape, and examples of protocols and software that still require it include OCSP, DNS, and the git version control system. (yes, git. she's iconic, she's also built on a broken hash, we don't talk about it 💀)
• EVP_md5() — implements the MD5 algorithm and produces 128 bits of output from a given input. she's still occasionally used when no security is required but a fast hash algorithm is beneficial. so like, checksums. vibes. nothing load-bearing. 🙈
• EVP_md5_sha1() — produces concatenated MD5 and SHA-1 message digests. Do not use this except where it is required for the historic SSLv3 protocol. that's it. that's the only excuse. it's giving museum exhibit 🔥
• EVP_md4() — implements the MD4 algorithm and produces 128 bits of output from a given input. it has been marked as “historic” by the Internet Engineering Task Force since 2011. the IETF put her in a glass case and everything ⭐

---

👑 RETURN VALUES 👑

these functions return pointers to static EVP_MD objects implementing the hash functions. so like, they hand you a shiny little object describing the digest, and you go do your EVP_DigestInit thing with it. 🫶

---

🔥 SEE ALSO 🔥

• evp(3)
• EVP_DigestInit(3)

---

💜 STANDARDS 💜

the receipts, in order, bestie 📚:

• T. Polk, L. Chen, S. Turner, and P. Hoffman, Security Considerations for the SHA-0 and SHA-1 Message-Digest Algorithms, RFC 6194, March 2011.
• S. Turner and L. Chen, Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms, RFC 6151, March 2011.
• S. Turner and L. Chen, MD4 to Historic Status, RFC 6150, March 2011.
• P. Kocher, P. Karlton, and A. Freier, The Secure Sockets Layer (SSL) Protocol Version 3.0, RFC 6101, August 2011.

---

🧚 HISTORY 🧚

the lore ✨:

• EVP_sha1() and EVP_md5() first appeared in SSLeay 0.5.1 and have been available since OpenBSD 2.4.
• EVP_md4() first appeared in OpenSSL 0.9.6 and has been available since OpenBSD 2.9.
• EVP_md5_sha1() first appeared in OpenSSL 1.1.0 and has been available since OpenBSD 6.3.

---

and that's the page, bestie 💖 sign-off time: this one's from the Debian build of the manual, dated June 8, 2025 — so go use a modern hash, drink some water, and slay 🌈🎀