title: Do I need to call MessageDigest.reset() before using it?
body: <p>The question is simple: when should I call the reset() function on the java class MessageDigest?</p>
  
  <p>The question mainly comes from the <a href="https://www.owasp.org/index.php/Hashing_Java" rel="nofollow">OWASP reference</a>, where in a code sample, they do:</p>
  
  <pre><code>   MessageDigest digest = MessageDigest.getInstance("SHA-1");
     digest.reset();
     digest.update(salt);
     byte[] input = digest.digest(password.getBytes("UTF-8"));
  </code></pre>
  
  <p>then, in a loop, they do:</p>
  
  <pre><code>   for (int i = 0; i &lt; iterationNb; i++) {
         digest.reset();
         input = digest.digest(input);
     }
  </code></pre>
  
  <p>Now, to me, it looks as if the reset is only required once the digest instance has already been 'polluted' with calls to update. The one in the first sample, therefore, does not seem necessary. If it is necessary, is it an indication that the instance returned by MessageDigest.getInstance is not thread safe?</p>
  
  <ul>
  <li><a href="https://www.owasp.org/index.php/Hashing_Java" rel="nofollow">OWASP hashing recommendation</a></li>
  <li><a href="http://www.mkyong.com/java/java-sha-hashing-example/" rel="nofollow">Random article on hashing, does not contain initial reset</a></li>
  </ul>