Strictly with respect to the use of MD5 in the caching provider, it would  be a trivial modification to create a custom provider that utilized SHA over the existing algorithm.  The use of the hash here is only superficially security-related, and was added to (i) ensure valid filenames and (ii) prevent naming collisions (which does remain a security consideration).  

I'll submit a work item for this issue, but just wanted to point out that the continued use of CE remains a possibility.  However, there are a number of uses of MD5 within the core itself that remain problematic (for all editions).

Brandon

---

Brandon Haynes
BrandonHaynes.org

Leith now I have access to the support/KB articles. I have looked at Articles 108 & 109 Do you by any chance know the Article ID that deals with details of disabling the FileBasedCaching and enabling the WebBasedCaching.  Is this an installation (PE) time option or is it something we can configure using host/admin settings.
We looked at the various "Caching" options under Host Settings/Performance Settings but don't see "WeBasedCaching" as an option we only see "File/Database/Memory".  Not sure if this is the correct option that we need to change.

Once again thanks a lot for your help.

Leith,First of all we are currently running under DNN 5.2.2.75 and are awaiting approval to upgrade to a higher version due to strict regulatory requirements. Not sure if we have to be at a higher DNN PE version to default to the WebBasedCacahing algorithms.The error we are getting seems to be confined only to some of our pages that use some of our custom modules. One page in particular is using a custom module to read an external XML file to populate an unordered list of links pretty much like the DNN's Links module except that the URLs are held in an XML file. The error message when run with FIPS enabled is the usual "This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms". The Event Log seems to point to the method "System.Security.Cryptography.MD5CryptoServiceProvider..ctor".I am not sure if the problem is due to accessing an external file(path / name). I am using an external file since the same file is used for other legacy apps as well and wanted to avoid duplication. Basically we are looking for workarounds available to DNN 5.2.2.75 users to be FIPS compliant.