Although SHA-1 theoretically has collisions, HMAC-SHA-1 which is based on SHA-1 is still widely used (in TLS for example) and is considered to be secure. How is that possible?
2
-
3$\begingroup$ cseweb.ucsd.edu/~mihir/papers/hmac-new.html $\;$ $\endgroup$– user991Aug 10, 2014 at 23:19
-
4$\begingroup$ The gist is that the HMAC construction has properties which allow its security definition to be met even if the hash used internally is not a cryptographic hash. It need only meet a weaker definition, which is why HMAC-MD5 is also still considered secure. $\endgroup$– pg1989Aug 10, 2014 at 23:43
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
As shown in the paper Ricky Demer linked in the comments, HMAC can be secure even when the underlying hash function is not collision resistant. Only PRF-ness of the hash function is required, and SHA-1 is not known to lack it. Or a couple of other conditions can suffice even if it isn't a PRF.
Intuitively, it makes sense that HMAC is secure as a MAC even with SHA-1, because a MAC does not allow a collision search. The only way to find the key would be to compromise the preimage resistance of SHA-1. HMAC in turn prevents length extension attacks and the like that would allow a forgery without knowing the key.
As an aside, even HMAC-MD5 hasn't been broken. However, for the same reason as there – attacks only get better – I would recommend not choosing SHA-1 as the HMAC hash for new applications if you can just as easily use SHA-2.
-
1
-
$\begingroup$ @mikeazo AFAICT that doesn't seem to qualify as an attack after all? $\endgroup$– otusMay 16, 2015 at 7:43