Wang's (et al) differential attack works on MD5, MD4, RIPEMD and HAVAL.

Why doesn't it work on SHA-1?

  • $\begingroup$ The website sites.google.com/site/itstheshappening has the details of another attack on SHA-1 from Marc Stevens (CWI, the Netherlands), Pierre Karpman (Inria, France and NTU Singapore) and Thomas Peyrin (NTU Singapore). $\endgroup$
    – kodlu
    Commented Dec 23, 2016 at 3:12

1 Answer 1


The message expansion step in SHA-1. The compression functions for MD4,MD5, RIPEMD and I think HAVAL only re-arrange and re-use words in the message block.

SHA-1 will expand the message from 16 words to 80 words using a rotation and XOR operation. The additional 64 words are a function of every word of the message block.

Because of this additional dependence on previous words in the block, Wang's attack will not work.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.