Embed Notice

@Edent There isn't any known attack against MD5 which would allow producing a file with a specific hash, but using it is very "fuck around and find out".

If you can't use BLAKE2/3 with a specified output size, use HMAC-SHA-256 with a fixed key such as "output truncated to 128 bits" to provide domain separation, then truncate.

There's some standard way to truncate SHA-256 to 128 bits, but I can't remember what spec it's in.