Revert "switch to md5; adjust format a bit"

This reverts commit d027ce144b.

pep-0552.txt

@@ -59,12 +59,13 @@ Python will begin to recognize two magic number variants for every pyc
 version. One magic number will correspond to the current pyc format and the
 other to "hash-based" pycs introduced by this PEP.
 
-In hash-based pycs, the second 32-bit field in the pyc header (currently the
-"timestamp" field) will become a bitset of flags. We define the lowest flag in
-this bitset called ``check_source``. This bitset field is followed by a 128-bit
-MD5 hash field. We choose MD5 because it is fast and sufficiently collision
-resistant for this application. No strong security properties are required
-here. (A truncated BLAKE2_ hash would also work.)
+In hash-based pycs, the second field in the pyc header (currently the
+"timestamp" field) will contain the SipHash_ (with a hardcoded key) of the
+contents of the source file. Another a fast hash like MD5 or BLAKE2_ would also
+work. We choose SipHash because Python already has a builtin implementation of
+it from :pep:`456`. The third field in the pyc header (currently the "source
+size" field) will become a bitset of flags. We define the lowest flag in this
+bitset called ``check_source``
 
 When Python encounters a hash-based pyc, its behavior depends on the setting of
 the ``check_source`` flag. If the ``check_source`` flag is set, Python will
@@ -93,6 +94,7 @@ References
 .. _reproducible build: https://reproducible-builds.org/
 .. _Bazel: https://bazel.build/
 .. _BLAKE2: https://blake2.net/
+.. _SipHash: https://131002.net/siphash/
 .. [#frozensets] http://benno.id.au/blog/2013/01/15/python-determinism
 .. [#interning] http://bugzilla.opensuse.org/show_bug.cgi?id=1049186
 .. _magic number: https://docs.python.org/3/library/importlib.html#importlib.util.MAGIC_NUMBER