Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I'm thinking about trying to save some space (and readability) when referencing 2k and 4k public keys (millions of them) by storing the fingerprint in some places instead of the full public key.

The primary threat to the security of a fingerprint is a preimage attack, where an attacker constructs a key pair whose public key hashes to a fingerprint which matches the victim's fingerprint. The attacker could then present his public key in place of the victim's public key to masquerade as the victim.

A secondary threat to some systems is a collision attack, where an attacker constructs multiple key pairs which hash to his own fingerprint. This may allow an attacker to repudiate signatures he has created, or cause other confusion. - Wikipedia

With this in mind, I was wondering about using a larger hashing algorithm like SHA-256 to help prevent collisions or collision attacks.

SHA1 seems to be the existing standard, but is it still the way to go?

share|improve this question
    
The known weaknesses in SHA-1 don't matter much since collisions aren't a big threat for fingerprints. So using it is okay. If you don't need compatibility with fingerprints computed by other software SHA-2 is probably a better idea. You can truncate it a bit if you want. –  CodesInChaos Jun 5 '13 at 17:48
    
Assuming Wikipedia is up to date, the most efficient attack against SHA1 still costs $2.77M for a single hash. Even if someone mounts a collision attack against you, you can still ask them to sign or encrypt something to verify their identity. From what I understand, you will only be using fingerprints to index keys in your database? –  rath Jun 6 '13 at 1:07
add comment

1 Answer

I understand that in 2005 SHA-1 was found to have a security flaw and the now recommended standard for this kind of thing is SHA-2 (256 or 512).

This post may be of some use: http://stackoverflow.com/questions/3897434/password-security-sha1-sha256-or-sha512

share|improve this answer
    
I'm more interested in collisions, not password security from hashing. Besides, I would use bcrypt for passwords to increase the time needed to hash them. –  Xeoncross Jun 5 '13 at 17:32
    
I believe the chances of a SHA-1 collision is something like 10^48. Or thereabouts. –  Jonny Wilson Jun 5 '13 at 17:40
    
@JonnyWilson $2^{160} \approx 10^{48}$ is the cost of a pre-image attack against SHA-1. A generic collision attack costs $2^{80}$, and thanks to SHA-1's weaknesses a collision attack is even cheaper. –  CodesInChaos Jun 5 '13 at 17:50
    
@Xeoncross The security weakness in SHA-1 is not limited to hashing passwords. They are directly related to an attacker being able to find a message m2 such that $H(m1) == H(m2) \vert| m1 != m2$, which is exactly the sort of issue that should concern you. It's still too difficult to generate collisions in practice, but the security properties of SHA-1 are only going to get weaker. When developing new software, choosing one of the SHA-2 algorithms is probably prudent. –  Stephen Touset Jun 6 '13 at 0:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.