# SHA-1 Keyed Hash Function

I know that SHA-1 is an unkeyed cryptographic hash function when used in practice. But, in the theory, all hash function are defined with keys. My question is:

• How I will be able to formalize the SHA-1 hash function using keys?
• In security proof, which approach could be used - theoretical or practical?
• cs.ucdavis.edu/~rogaway/papers/ignorance.pdf $\;$ – user991 Nov 12 '13 at 15:19
• @RickyDemer yes I'm reading that paper, and I understand the follow: In the practice is used hash functions without keys. In practice a function F is free-collision if not exists efficient algorithm know to man that outputs a collision in F. But in the theory (keyed hash functions), collision free is defined than not exists person such that is able to found collisions. But for me is the same ... My deduction is wrong? – juaninf Nov 12 '13 at 16:41

We are talking about hash-function families $\{h_k\}_{k\in K}$ here. The parameter $k$ is used to rule out the trivial collision search algorithm that simply prints a collision for a given $h$ (such algorithms exist, but are difficult to find). For large $K$ such an algorithm would be too large. The parameter $k$ is called a key, but it is not actually secret.
The issue is that concrete hash-functions are unkeyed. This is not a problem in practice, since such printing'' algorithms are never found. However, to prove the security of a protocol that uses such a hash function, one needs to show a proper reduction: the protocol is secure as long as the hash function is collision free. The latter is easily formulated for keyed hash functions, but for a single hash function it has been formalized rather recently. This answers your second question.