Rule Definition
The use of a non-standard algorithm is dangerous because a determined attacker may be able to break the algorithm and compromise whatever data has been protected. Well-known techniques may exist to break the algorithm.

Remediation
Avoid using MD5 or SHA1 hashes as input to cryptographic functions or to store passwords. The following hashing algorithms: SHA256, SHA384, and SHA512 are recommanded instead. Make sure you choose the most appropriate one, depending on your use case, security requirements and runtime constraints. SHA-256 is a 256-bit hash function intended to provide 128 bits of security against collision attacks, while SHA-512 is a 512-bit hash function intended to provide 256 bits of security. A 384-bit hash may be obtained by truncating the SHA-512 output

Violation Code Sample

Sample 1 : 
private static String getSalt() throws NoSuchAlgorithmException 
{ 
SecureRandom sr = SecureRandom.getInstance(“SHA1PRNG”); 
byte[] salt = new byte[16]; 
sr.nextBytes(salt); 
return salt.toString(); 
} 
___________________________________________________________ 
Sample 2 
MessageDigest md5Digest = MessageDigest.getInstance("MD5"); 
    md5Digest.update(password.getBytes()); 
    byte[] hashValue = md5Digest.digest(); 

byte[] hashValue = DigestUtils.getMd5Digest().digest(password.getBytes());

Fixed Code Sample

Remediation for Sample 1 
private static String getSalt() throws NoSuchAlgorithmException 
{ 
SecureRandom sr = SecureRandom.getInstance(“SHA-256”);
byte[] salt = new byte[16]; 
sr.nextBytes(salt); 
return salt.toString(); 
} 
____________________________________________________________ 
Remediation for Sample 2 
Solution (Using bouncy castle): 

public static byte[] getEncryptedPassword(String password, byte[] salt) throws NoSuchAlgorithmException, InvalidKeySpecException 
 { 
    PKCS5S2ParametersGenerator gen = new PKCS5S2ParametersGenerator(new SHA256Digest()); 
    gen.init(password.getBytes("UTF-8"), salt.getBytes(), 4096); 
    return ((KeyParameter) gen.generateDerivedParameters(256)).getKey(); 
} 

Solution (Java 8 and later): 
public static byte[] getEncryptedPassword(String password, byte[] salt) throws NoSuchAlgorithmException, InvalidKeySpecException 
{ 
    KeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 4096, 256 * 8); 
    SecretKeyFactory f = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256"); 
    return f.generateSecret(spec).getEncoded(); 
}

https://cwe.mitre.org/data/definitions/327.html https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure