1
$\begingroup$

I'm curious if it's safe to use sha1 for an HMAC in 2018 in a platform product.

A popular vendor (Twilio) uses an HMAC with sha1 with a shared secret to validate that messages they send are indeed sent by them (see the Twilio docs on validating messages)..

In a recent audit, the use of sha1 was flagged as a potential problem.

As part of the explanation and justification for why it is OK to use hmac-with-sha1, Twilio pointed to this article about hmac with sha1, though I note that article is from 2009.

So, what say you crypto.stackexchange? Is it still safe in 2018 for an organization like Twilio to use sha1 in an HMAC?

Improve this question
$\endgroup$
1
  • $\begingroup$ Yes, still secure, but they should migrate away none-the-less. If they say that this is impossible you can ask them to explain why it is impossible for them to upgrade the protocol and consequently what their upgrade strategy is. That question will probably make them sweat a bit :) $\endgroup$
    – Maarten Bodewes ♦
    Jul 24, 2018 at 0:59

0

Reset to default

Browse other questions tagged or ask your own question.