Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have three questions:

  1. Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication?
  2. How much HMAC-SHA256 is slower than HMAC-SHA1?
  3. Are the security improvements of SHA256 (over SHA1) enough to justify its usage?
share|improve this question
    
#2 if you are not a service performing millions of hashes, both of them should take a miniscule fraction of a second (for a reasonably small message). –  Richie Frame Apr 4 at 1:49

1 Answer 1

Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication?

Yes.

That is a semi-serious answer; both are very good choices, assuming, of course, that a Message Authentication Code is the appropriate solution (that is, both sides share a secret key), and you don't need extreme speed.

How much HMAC-SHA256 is slower than HMAC-SHA1?

Those sorts of crypto performance questions are quite platform specific, and so it's hard to answer definitively. In my experience, I've seen SHA-1 (and hence HMAC-SHA-1) be about 30% faster than SHA-256; Your Mileage May Vary, of course.

Of course, the obvious comeback is "how much is this performance delta important to you?". That rather depends on how fast you're adding/checking integrity tags.

Are the security improvements of SHA256 (over SHA1) enough to justify its usage?

To the best of our knowledge, there is essentially no security difference between HMAC-SHA256 and HMAC-SHA1; with a sufficiently long key, both are impervious to brute force, and with a reasonably long tag, both will catch any forged messages with the expected probability. There is a known weakness to SHA1 that allows someone to compute a collision in less time than expected; there is no known way to apply that to HMAC-SHA1, and so there are no known methods of attack (other than, as I mentioned just now, brute force, and guessing the tags randomly).

share|improve this answer
    
Addendum. In section 6 of the HMAC specification it explains the unfeasibility of the currently best known attack. And HMAC calls the hash function only two times so the speed is pretty negligible. As for the output size, that may be a factor especially if you're sending hashes over a network. However, it's also acceptable to truncate the output of the HMAC to a certain length. So really, choosing between SHA1 and SHA256 doesn't make a huge difference. Might as well stick with SHA1. –  user3100783 Apr 4 at 1:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.