SHA-1 has not been secure for a very long time, but I still can see it here.

Where in the FIPS documents did it state that SHA-1 is not secure?

  • 1
    $\begingroup$ Here is the paper introduction the SHA-3 competition. While it does not say that SHA-1 is not secure, it motivates the competition. Here is a paper from NIST about the transition. $\endgroup$ – Biv May 31 '16 at 15:28
  • $\begingroup$ There are various NIST documents that say SHA-1 will be disallowed because it does not meet 112-bit security, which was specified as the minimum for certain applications after specific dates $\endgroup$ – Richie Frame Jun 1 '16 at 1:05

Much of what NIST publishes about cryptographic algorithms is in Special Publications. In this case it is SP 800-131 (pdf) where they describe transitioning away from old algorithms and key sizes.

Pages 14-15 have the hash function specific information:

SHA-1 for digital signature generation:

     SHA-1 may only be used for digital signature generation where specifically allowed by NIST protocol-specific guidance. For all other applications, SHA-1 shall not be used for digital signature generation.

SHA-1 for digital signature verification:

     For digital signature verification, SHA-1 is allowed for legacy-use.

SHA-1 for non-digital signature applications:

     For all other hash function applications, the use of SHA-1 is acceptable. The other applications include HMAC, Key Derivation Functions (KDFs), Random Bit Generation, and hash-only applications (e.g., hashing passwords and using SHA-1 to compute a checksum, such as the approved integrity technique specified in Section 4.6.1 of [FIPS 140]).

FIPS 140, being the document you linked in the question, points to this document for guidance.

  • $\begingroup$ Allowing "SHA-1 to compute a checksum" seems like a dubious idea, since those can easily depend on collision resistance. $\endgroup$ – CodesInChaos Jun 1 '16 at 9:17
  • $\begingroup$ @CodesInChaos, maybe it means non-cryptographic integrity protection? The section 4.6.1 "integrity test" seems to allow use of an error detection code, so it is presumably only meant to catch non-malicious errors. $\endgroup$ – otus Jun 1 '16 at 9:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.