# What is hardened SHA-1, how does it work and how much protection does it offer?

From the shattered website:

You can use the online tool above to submit files and have them checked for a cryptanalytic collision attack on SHA-1. The code behind this was developed by Marc Stevens (CWI) and Dan Shumow (Microsoft) and is publicly available on GitHub.

It is based on the concept of counter-cryptanalysis and it is able to detect known and unknown SHA-1 cryptanalytic collision attacks given just a single file from a colliding file pair.

And later:

## Is Hardened SHA-1 vulnerable?

No, SHA-1 hardened with counter-cryptanalysis (see ‘how do I detect the attack’) will detect cryptanalytic collision attacks. In that case it adjusts the SHA-1 computation to result in a safe hash. This means that it will compute the regular SHA-1 hash for files without a collision attack, but produce a special hash for files with a collision attack, where both files will have a different unpredictable hash.

finally from the GitHub pages - which I assume is called "hardened" SHA-1 above:

... More specifically they will detect any cryptanalytic collision attack against SHA-1 using any of the top 32 SHA-1 disturbance vectors with probability 1:

I(43,0), I(44,0), I(45,0), I(46,0), I(47,0), I(48,0), I(49,0), I(50,0), I(51,0), I(52,0),
I(46,2), I(47,2), I(48,2), I(49,2), I(50,2), I(51,2),
II(45,0), II(46,0), II(47,0), II(48,0), II(49,0), II(50,0), II(51,0), II(52,0), II(53,0), II(54,0), II(55,0), II(56,0),
II(46,2), II(49,2), II(50,2), II(51,2)


What precisely are these vectors? Could there be other vectors that are vulnerable? How much protection does "hardened" SHA-1 offer?

Hardened SHA-1 detects collisions built of a certain form, If someone were to find a collision using brute-force birthday attack (currently not feasible) the detection would not work.

The vectors are specific small differences which may help to convert a near collision into a full collision.

The details are in the paper: https://marc-stevens.nl/research/papers/C13-S.pdf

This will detect an attack which has a similar construction to the attack performed. Future cryptanalysis may however lead to other forms of attack. It is worth mentioning any hash function that is may be vulnerable to new kinds of attacks though. SHA-3 may also be vulnerable to attacks that are yet unknown.

Hardened SHA-1 tries to be identical to SHA-1 almost all the time with a probability of differing in honest usage of less than $2^{-90}$. Yet it should be resilient to attacks by detecting them and changing the output to something that differs.

SHA-1 has been collision free until very recently. Hardened SHA-1 should be secure in this regard; much more secure then SHA-1. It is obviously better than thoroughly broken options such as MD5.

Hardened SHA-1 tries to be backwards compatible with SHA-1. If you don't need this backward compatibility don't use it, use SHA-3 or SHA-2, even if you have to truncate to 160 bits.

• I've made some superficial changes to the answer (mostly with regards to language use), and I've put the warning about using other hash functions below the answer. Could you however explain what you mean with "honest usage"? Oh and thanks for the answer of course, already upvoted! – Maarten Bodewes Feb 23 '17 at 21:03
• I read "honest usage" as operating on non-malicious input, i.e. input acceptably modeled as random and not specifically crafted to exploit the weaknesses of SHA-1 – bmm6o Feb 24 '17 at 0:08
• I think I understand after parsing the text again. If the collision attack is tried then it will of course not be identical to the original SHA-1 output as it would trigger the change of output with a much higher certainty than $2^{-90}$ (more like a chance of 1 for the current attack). Makes sense, thanks bmm60. – Maarten Bodewes Feb 24 '17 at 0:18
• @Maarten Bodewes: So far, I do not see that Could there be other vectors that are vulnerable? How much protection does "hardened" SHA-1 offer? is addressed. The paper contains the admission "we propose (a bit arbitrarily) to limit ourselves to the following 14 best disturbance vectors", which at least opens the possibility to use another one, and evade detection, with some unspecified but (I imagine) not-tremendous extra cost of attack. – fgrieu Mar 7 '17 at 16:20
• The threshold is somewhat arbitrary, and was increased from 14 in the original paper to 32. These are the best disturbance vectors for mounting an attack similar to the one performed, avoiding all these while using a similar attack framework would mount a less effective attack, I haven't seen an analysis of the runtime of an attack using the next in line disturbance vectors. I suspect it is significant, though probably still better then 2^80 – Meir Maor Mar 8 '17 at 6:18