# *feasible* pre-image attacks against reduced SHA-1

(tldr: see last paragraph)

Although SHA-1 is vulnerable to collision attacks, it is still resistant to pre-image attacks. SHA-1 was designed to be resistant until a brute-force attack of $2^{160}$ is possible, as 160 is the block size of SHA-1.

(Round-) Reduced pre-image attacks are attacks that try to find pre-images for less than the 80 rounds. The best reduced pre-image attack against SHA-1 I could find takes $2^{159.3}$ for 57 rounds. This leads to the following:

1. The normal 80 rounds of SHA-1 are still fully 160-bit resistant against pre-image attacks.
2. This (and most other I could find in literature) reduced pre-image attacks are of a theoretical nature: They show that less rounds can be done slightly better than brute-force, but are still impossible to carry out practically.

This makes me wonder what's the status of feasible/practical attacks. For example, there's a masters thesis that cracks 23 rounds between the lines, but doesn't claim it and doesn't say anything about the state of science on this subject.

When given a 160 bit string, how many rounds have been claimed by science to feasibly find a (round-reduced) pre-image in SHA-1? Say someone could pre-image $000...000$ for x rounds and proves so by showing a pre-image, what should x be to have something worth an article?

## migrated from cs.stackexchange.comDec 3 '17 at 12:27

This question came from our site for students, researchers and practitioners of computer science.

• I guess there is always a balance between the feasibility of an attack and the number of rounds. $2^{160}$ for the full number of rounds is clearly not feasible, but what is feasible? I doubt that anybody created a formula that balances these two variables. Or three if you both use CPU and memory requirements. – Maarten Bodewes Dec 3 '17 at 12:46