If hashing algorithms such as MD5 or SHA1 both use Merkle-Damgard constructions at their cores, why is it so easy to break them, and yet so much harder to break SHA3, which is also MDC based?


MD5 and SHA-1 have been broken (from a collision-resistance perspective) due to weaknesses of their compression function, not because they are Merkle–Damgård based.

SHA-2 hashes (SHA-256, SHA-512..) are Merkle–Damgård based, but use more compute-intensive compression functions, and are so far unbroken.

SHA-3 is not Merkle–Damgård based, it uses the sponge construction. One advantage is that the result does not reveal the full state, and that makes the construction immune to the length-extension attack.

  • $\begingroup$ My mistake about SHA3 being MDC based. I was unsure whether that was correct. Thank you for the correction. $\endgroup$ – user83024 May 27 '18 at 15:46
  • $\begingroup$ I don't think there has been any published attacks breaking SHA-2 or even coming close. The is the length extension problem which don't break a hash function under certain definitions. And I can think of a post on "A distinguisher for SHA256 using Bitcoin" which draws a conclusion that I'm not aware of anyone regarding as legitimate. $\endgroup$ – Future Security May 28 '18 at 23:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.