We know that SHA-1 is susceptible to collision attacks, but what about pre-image attacks such as poisoning torrents?


1 Answer 1


To my knowledge, the SHA-1 hash function is still believed to have 160-bits of pre-image resistance against classical computation.

There have been results showing that reducing the number of rounds in SHA-1 to below the stipulated 80 allow pre-images to be found subexhaustively. Specifically, De Canniere and Rechberger's Crypto 2008 paper Preimages for Reduced SHA-0 and SHA-1 claim a pre-image attack taking on 44-round SHA-1 roughly $2^{157}$ evaluations. This seems to indicate that cryptanalysis is not yet close to a full pre-image attack.

Nevertheless, SHA-1 should be deprecated as the collision attack means that it should not be offered as a legacy option in cryptographic libraries in order to avoid downgrade attacks in applications where collision resistance is required.

  • 2
    $\begingroup$ thanks for this informative answer, so to my understanding the state of the art for pre-image (unlike collision) has not really improved. $\endgroup$
    – kodlu
    Nov 30, 2022 at 14:55
  • 1
    $\begingroup$ Even MD5 is quite preimage resistant (though you still shouldn't use it!). $\endgroup$
    – forest
    Nov 30, 2022 at 23:31
  • $\begingroup$ @forest True, but also worth mentioning the impressive work by Sasaki and Aoki finding a subexhaustive attack on MD5 preimage. $\endgroup$
    – Daniel S
    Dec 1, 2022 at 7:55
  • $\begingroup$ @kodlu collision attack is the first one to break since it gives the attacker more control. $\endgroup$
    – kelalaka
    Dec 1, 2022 at 14:00
  • $\begingroup$ @DanielS the MD5's attack's real cost is larger than the direct brute force in practice. The main reason is the memory cost. The attack's real cost must be counted with the memory cost, too, That is always mentioned by DJB. Consider the novel DES attacks ( linear and differential), they are faster, however, the real cost is much higher so that none ever build them, we have only brute-force attacks on DES. $\endgroup$
    – kelalaka
    Dec 2, 2022 at 19:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.