Change the cache CryptoHash default from MD5 to SHA256

[c-taylor]

Certainly you could look at other algorithms, but SHA256 is already the fips alternative.
It makes sense to also add another stronger/faster for algorithm agility at the same time.

---

Hash Algorithm Benchmark — OpenSSL speed across 4 CPUs

Max hashes/sec @ 16B (smallest objects — per-call ceiling)

CPU	SHA-NI	SHA-512 hw	MD5	SHA-256	SHA-512	Best
9555P (Zen 5, 2024)	✅	✅	8.46 M/s	11.59 M/s	5.68 M/s	SHA-256
EPYC 7502P (Zen 2, 2019)	✅	❌	3.19 M/s	3.92 M/s	1.89 M/s	SHA-256
Xeon 5218 (Cascade Lake, 2019)	❌	❌	3.78 M/s	2.77 M/s	2.11 M/s	MD5
E5-2660v3 (Haswell, 2014)	❌	❌	3.11 M/s	2.15 M/s	1.51 M/s	MD5

Bulk throughput @ 16KB (MB/s)

CPU	SHA-NI	SHA-512 hw	MD5	SHA-256	SHA-512	Best
9555P (Zen 5, 2024)	✅	✅	951	2,107	1,223	SHA-256
EPYC 7502P (Zen 2, 2019)	✅	❌	582	1,468	531	SHA-256
Xeon 5218 (Cascade Lake, 2019)	❌	❌	580	376	559	MD5
E5-2660v3 (Haswell, 2014)	❌	❌	541	291	418	MD5

Generational speedup vs E5-2660v3 baseline (16KB bulk)

CPU	MD5	SHA-256	SHA-512
9555P (Zen 5, 2024)	1.76×	7.25×	2.93×
EPYC 7502P (Zen 2, 2019)	1.08×	5.05×	1.27×
Xeon 5218 (Cascade Lake, 2019)	1.07×	1.29×	1.34×
E5-2660v3 (Haswell, 2014)	1.00×	1.00×	1.00×

Key

• SHA-NI: hardware SHA-256 acceleration (x86 SHA Extensions)
• SHA-512 hw: hardware SHA-512 acceleration (AMD Zen 5+)
• SHA-256 wins on any CPU with SHA-NI, often by 2–2.5× over MD5
• On non-SHA-NI CPUs, SHA-512 beats SHA-256 in bulk (1.44×) due to 64-bit word size advantage
• MD5 is fastest only on legacy Intel CPUs lacking SHA-NI, and only marginally so vs SHA-512

[masaori335]

You might be interested in this old PR. #8755

[phongn]

Do we need a cryptographically secure hash for the cache? If so, we should switch, even if MD5 is slow on older platforms. SHA-256 is perfectly fine for that, and SHA-512/256 even better on any 64-bit system (note, this is not SHA-512 or SHA-256). If we need more speed on older platforms, we might consider BLAKE3. That said, it looks like CryptoHash prefers 64-bit hash keys? We might be able to use something like SipHash given we don't use the full size of even MD5.

If we don't need a cryptographically secure hash, we might as well do what was suggested by @masaori335 : switch to something like xxHash or rapidhash or umash (see https://github.com/rurban/smhasher for some basic tests).

cc: @bneradt