Should we assume SHA-1? I realise SHA-1 is an improvement on md5, but is md5 sufficient given that (I assume) it is faster?