switch to md5; adjust format a bit

pep-0552.txt

@@ -59,13 +59,12 @@ Python will begin to recognize two magic number variants for every pyc
 version. One magic number will correspond to the current pyc format and the
 other to "hash-based" pycs introduced by this PEP.
 
-In hash-based pycs, the second field in the pyc header (currently the
-"timestamp" field) will contain the SipHash_ (with a hardcoded key) of the
-contents of the source file. Another a fast hash like MD5 or BLAKE2_ would also
-work. We choose SipHash because Python already has a builtin implementation of
-it from :pep:`456`. The third field in the pyc header (currently the "source
-size" field) will become a bitset of flags. We define the lowest flag in this
-bitset called ``check_source``
+In hash-based pycs, the second 32-bit field in the pyc header (currently the
+"timestamp" field) will become a bitset of flags. We define the lowest flag in
+this bitset called ``check_source``. This bitset field is followed by a 128-bit
+MD5 hash field. We choose MD5 because it is fast and sufficiently collision
+resistant for this application. No strong security properties are required
+here. (A truncated BLAKE2_ hash would also work.)
 
 When Python encounters a hash-based pyc, its behavior depends on the setting of
 the ``check_source`` flag. If the ``check_source`` flag is set, Python will
@@ -94,7 +93,6 @@ References
 .. _reproducible build: https://reproducible-builds.org/
 .. _Bazel: https://bazel.build/
 .. _BLAKE2: https://blake2.net/
-.. _SipHash: https://131002.net/siphash/
 .. [#frozensets] http://benno.id.au/blog/2013/01/15/python-determinism
 .. [#interning] http://bugzilla.opensuse.org/show_bug.cgi?id=1049186
 .. _magic number: https://docs.python.org/3/library/importlib.html#importlib.util.MAGIC_NUMBER