(tldr: see last paragraph)

Although SHA-1 is vulnerable to collision attacks, it is still resistant to pre-image attacks. SHA-1 was designed to be resistant until a brute-force attack of $2^{160}$ is possible, as 160 is the block size of SHA-1.

(Round-) Reduced pre-image attacks are attacks that try to find pre-images for less than the 80 rounds. The best reduced pre-image attack against SHA-1 I could find takes $2^{159.3}$ for 57 rounds. This leads to the following:

  1. The normal 80 rounds of SHA-1 are still fully 160-bit resistant against pre-image attacks.
  2. This (and most other I could find in literature) reduced pre-image attacks are of a theoretical nature: They show that less rounds can be done slightly better than brute-force, but are still impossible to carry out practically.

This makes me wonder what's the status of feasible/practical attacks. For example, there's a masters thesis that cracks 23 rounds between the lines, but doesn't claim it and doesn't say anything about the state of science on this subject.

When given a 160 bit string, how many rounds have been claimed by science to feasibly find a (round-reduced) pre-image in SHA-1? Say someone could pre-image $000...000$ for x rounds and proves so by showing a pre-image, what should x be to have something worth an article?

  • $\begingroup$ I guess there is always a balance between the feasibility of an attack and the number of rounds. $2^{160}$ for the full number of rounds is clearly not feasible, but what is feasible? I doubt that anybody created a formula that balances these two variables. Or three if you both use CPU and memory requirements. $\endgroup$ – Maarten Bodewes Dec 3 '17 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.