Please forgive me if this question belongs on different StackExchange site.A much more experienced colleague (like, 8 times more experienced than me) has vigorously defended an idea that you should check multiple hash types (md5, sha1 etc.) as well as size to be absolutely sure that given file is not a duplicate of another.I think it's BS and that it's enough to check the strongest hash used (though even md5 seems strong enough in this context). This already gives me more assurance than any weaker hash, so combining the two doesn't really add any benefits.Am I right or wrong? I found multiple explanations that deal with crypto, but those aren't directly applicable.
Does it make sense to check multiple hashes when detecting a file duplicate?
hashing;engineering
Against accidental collisions, pretty much any decent hash with sufficient output size works. Even broken functions like MD5 (and soon SHA-1) are very unlikely to produce accidental collisions.Against deliberate collisions concantenating multiple hashes gives you a hash as strong as the strongest individual. But probably not stronger than that.It's generally better to upgrade to a stronger hash function rather than combining two weak hashes. I recommend SHA-2 and SHA-3 as collision resistant hashes. At 256+ bits, accidental collisions are so unlikely that you can completely ignore that possibility. And deliberate collisions are far beyond current publicly known cryptoanalysis.SHA256 > MD5 + SHA1