Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that SHA-1 is an unkeyed cryptographic hash function when used in practice. But, in the theory, all hash function are defined with keys. My question is:

  • How I will be able to formalize the SHA-1 hash function using keys?
  • In security proof, which approach could be used - theoretical or practical?
share|improve this question
1 $\;$ – Ricky Demer Nov 12 '13 at 15:19
@RickyDemer yes I'm reading that paper, and I understand the follow: In the practice is used hash functions without keys. In practice a function F is free-collision if not exists efficient algorithm know to man that outputs a collision in F. But in the theory (keyed hash functions), collision free is defined than not exists person such that is able to found collisions. But for me is the same ... My deduction is wrong? – juaninf Nov 12 '13 at 16:41
up vote 3 down vote accepted

We are talking about hash-function families $\{h_k\}_{k\in K}$ here. The parameter $k$ is used to rule out the trivial collision search algorithm that simply prints a collision for a given $h$ (such algorithms exist, but are difficult to find). For large $K$ such an algorithm would be too large. The parameter $k$ is called a key, but it is not actually secret.

The issue is that concrete hash-functions are unkeyed. This is not a problem in practice, since such ``printing'' algorithms are never found. However, to prove the security of a protocol that uses such a hash function, one needs to show a proper reduction: the protocol is secure as long as the hash function is collision free. The latter is easily formulated for keyed hash functions, but for a single hash function it has been formalized rather recently. This answers your second question.

For the first question, there is no standard way of making a keyed hash function out of SHA-1, because this is not needed in practice. One may think of HMAC-SHA-1, but I doubt its collision resistance when the key is known (it is probably reduced to the chosen-prefix attack).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.