Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Why is SHA1 preimage-resistant? The best reference that I can find is Rogaway & Shrimpton's 2009 paper, and I'll use their definitions. The kind of preimage resistance that is wanted is aPre. There is a provisional (but strong enough, since the compression function goes from 512 to 160 bits) implication of aSec->aPre. But there is no implication from Coll->aSec (or from anything else ->aSec, for that matter), and most of the published work concentrates on Coll. So, perhaps I should ask: why is SHA1 second-preimage-resistant?

We know that the RSA public-key cryptosystem is based on the inherent difficulty of factoring large primes. Is there a similar intractable problem that lies behind second-preimage resistance?

share|improve this question
the generalizations on key recovery from block ciphers using differential or linear analysis is what you should be looking at, since the message is treated as the key to a block cipher in SHA – Richie Frame Dec 9 '14 at 11:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.