diff --git a/src/cryptobox/core/settings.py b/src/cryptobox/core/settings.py
index 1bf1632..7ffe338 100644
--- a/src/cryptobox/core/settings.py
+++ b/src/cryptobox/core/settings.py
@@ -443,7 +443,15 @@ class CryptoBoxSettings:
     def __get_user_db(self):
         """Load the user database file if it exists.
         """
-        import StringIO, sha
+        import StringIO
+        try:
+            # hashlib is available since python2.5
+            import hashlib
+            get_hash_obj = lambda text: hashlib.sha1(text)
+        except ImportError:
+            # sha is deprecated since python2.6
+            import sha
+            get_hash_obj = lambda text: sha.new(text)
         user_db_rules = StringIO.StringIO(self.userDatabaseSpec)
         try:
             try:
@@ -468,7 +476,7 @@ class CryptoBoxSettings:
         ## validate and set default value for "admin" user
         user_db.validate(validate.Validator())
         ## define password hash function - never use "sha" directly - SPOT
-        user_db.get_digest = lambda password: sha.new(password).hexdigest()
+        user_db.get_digest = lambda password: get_hash_obj(password).hexdigest()
         return user_db