> I'd like to suggest switching to a stronger hash that is not broken. Calling SHA1 "broken" are we? Please demonstrate. Quoted from the linked Site: - This: >Who is capable of mounting this attack? >This attack required over 9,223,372,036,854,775,808 SHA1 computations. This took the equivalent processing power as 6,500 years of single-CPU computations and 110 years of single-GPU computations. - and this: >How widespread is this? >As far as we know our example collision is the first ever created. - and this: >Has this been abused in the wild? >Not as far as we know. 110 CPU years... SQLite's release cycle alone will thwart any prospective attacker. To leverage this attack against SQLite someone will have to spend considerably more resources than the average attacker possesses and even then, after having successfully crafted a SHA1 for the code, all of which are *considerably* larger than the PDF used in the demonstration (upon which the attack figures is based), then such an attacker also has to successfully hack the SQLite servers and post such code on there. I'm all for changing to a different completely un-attacked hash algorithm, but the notion that the current implementation is in any way unsafe or broken is just silly. When people start calling security of any system "broken", "shattered" or "we're just inviting criminals now", my normal response to such claims is: Prove it. Break it. I'll afford the OP an even easier challenge: Forget for a moment the need to break into SQLite's servers - but simply show me an amalgamation (freely downloadable) with added demonstrably malicious code and the same SHA1 hash as the on-line posted one. (I'll even accept it if you got help from those folks who fashioned the PDF's colliding hash). Upon that I will rescind my voice on the matter, eat my own hat, and completely join the band of protestors wanting an upgrade to that hashing algorithm soonest. Until then, when requesting people to do work for no valid proven reason at all, kindly accompany any such request with a substantial monetary donation.