I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying function of my hash-based signature. But I'm not sure if it still makes sense to use SHA1 due to its vulnerabilities. Is there a scenario in which would be acceptable to use SHA1?
$\begingroup$
$\endgroup$
-
1$\begingroup$ I suppose it depends on the specific scheme but e.g. in this paper the security proof relies on second preimage resistance, for which SHA1 would still be fine. $\endgroup$ – puzzlepalace Jun 26 '17 at 19:02
-
$\begingroup$ Note however, that you would need to avoid pre-hashing with SHA-1 which may or may not be tricky. $\endgroup$ – SEJPM♦ Jun 26 '17 at 19:37
-
1$\begingroup$ fwiw, sha256 runs faster on ardunio than sha1. $\endgroup$ – dandavis Jun 26 '17 at 19:47
$\begingroup$
$\endgroup$
No, use SHA256.
If you look at https://bench.cr.yp.to/results-hash.html it seems that SHA256 would probably be the better choice concerning speed as well. Therefore I don't see a good reason to go with SHA-1.
