If hashing algorithms such as MD5 or SHA1 both use Merkle-Damgard constructions at their cores, why is it so easy to break them, and yet so much harder to break SHA3, which is also MDC based?
$\begingroup$
$\endgroup$
Add a comment
|
$\begingroup$
$\endgroup$
2
MD5 and SHA-1 have been broken (from a collision-resistance perspective) due to weaknesses of their compression function, not because they are Merkle–Damgård based.
SHA-2 hashes (SHA-256, SHA-512..) are Merkle–Damgård based, but use more compute-intensive compression functions, and are so far unbroken.
SHA-3 is not Merkle–Damgård based, it uses the sponge construction. One advantage is that the result does not reveal the full state, and that makes the construction immune to the length-extension attack.
-
$\begingroup$ My mistake about SHA3 being MDC based. I was unsure whether that was correct. Thank you for the correction. $\endgroup$ – user83024 May 27 '18 at 15:46
-
$\begingroup$ I don't think there has been any published attacks breaking SHA-2 or even coming close. The is the length extension problem which don't break a hash function under certain definitions. And I can think of a post on "A distinguisher for SHA256 using Bitcoin" which draws a conclusion that I'm not aware of anyone regarding as legitimate. $\endgroup$ – Future Security May 28 '18 at 23:38
