Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Could anyone tell me what the difference is between a THEORETICAL ATTACK (Like the one done on SHA-1) and an actual attack (Like the one done on SHA-0). Is a theoretical attack a proposed method of attacking, that no one's ever done due to lack of resources (like computing power)?

Thanks in-advance,


share|improve this question
You've pretty much got it right. Theoretical means it probably works (if the researchers got the math right) but it's too expensive to attempt yet. – Thomas Jul 8 '13 at 17:10
Oh. Cool. I was just guessing. But, if that's true, why would people go through the time and money to develop another system (SHA-2), if the attack wasn't even proven to work? – Thomas Gouder Jul 8 '13 at 17:26
Is a theoretical attack enough to begin developing a new system? – Thomas Gouder Jul 8 '13 at 17:45
Mainly because "attacks only get better" A theoretical attack means, that somebody has found a way to attack the system faster than expected. This often leads to a series of better and better attacks until we have something that can actually be used against the system in practice. – Maeher Jul 8 '13 at 18:17
Ah, understood. – Thomas Gouder Jul 8 '13 at 18:27

1 Answer 1

up vote 1 down vote accepted

A theoretical attack is an attack strategy that was born out of “theory”, “calculation”, and — in the least cases — “simulation”. Yet, the strategy is yet to be proven in practice.

An actual attack which is practically proven and can be replicated is actual proof that a theoretical attack works. Therefore, the first is an indication of a weakness, while an actual attack is proof that that weakness actually exists.

It's actually not so much different from every regular science project. A theory is just a theory until someone can prove the theory is correct... transforming the theory into a fact.

In your SHA examples, SHA-0 is practically proven to have a weakness and - depending on available resources available for the attack - that weakness translates into "it's broken".

SHA-1 on the other hand shows that - in theory - it's broken too. But no one managed (or took the time) to actually put the theory in practice to prove it's indeed broken.

Personally, I regard "theoretical attack vectors and/or strategies" as a warning, while I regard "practically broken" as a red alert. After all, a theory could have some flaw rendering it void, but if someone has practically broken something, statistical chances that others will do the same rise every second.

share|improve this answer
The term "theoretical attack" typically refers to an algorithm that can be proven to work using abstract means (such as logic and mathematics), but has a running time that is too great to be carried out in practice. In that sense, your answer is misleading. – Henrick Hellström Jul 8 '13 at 19:27
@HenrickHellström I disagree. There are more reasons than "has a running time that is too great to be carried out in practice" why some theoretical attacks are not or can not be put into practice. In contrast to your opinion, I would say that by only listing "missing resources", you're leaving out more than half of the story and that is more qualified to be called "misleading". To give you only two examples of (many) other reasons: (1) no one cares to prove a theory because other attacks are already known to work, (2) a crypto theory with a theoretical attack doesn't make sense to be proven. – e-sushi Jul 8 '13 at 19:41
Well, in the case of SHA-1 the previous conjecture that it was cryptographically secure, was based on the assumption that it was hard to get differential paths across all 80 rounds. The best attack provides a method for constructing such paths that would make it statistically unlikely for the attack not to work. While not proving the existence of actual collisions with absolute certainty, it is at least as good as any empirical evidence to the contrary. – Henrick Hellström Jul 8 '13 at 20:05
@HenrickHellström I think you take this from the wrong corner as you write "statistically unlikely". Cryptographic scientists - like all scientists - do not use statistical proof as a means to attain certainty, but to falsify claims and explain theory. Statistical proof offers a kind of proof of a theories falsity and the means to learn heuristically through repeated statistical trials and experimental error. Statistics cannot achieve absolute certainty nor is it a continuous march toward an objective truth as the vernacular as opposed to the scientific meaning of the term proof might imply. – e-sushi Jul 8 '13 at 20:15
Another idea would of course be that you edit your answer. – Henrick Hellström Jul 8 '13 at 23:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.