1
$\begingroup$

This question already has an answer here:

I'm curious if it's safe to use sha1 for an HMAC in 2018 in a platform product.

A popular vendor (Twilio) uses an HMAC with sha1 with a shared secret to validate that messages they send are indeed sent by them (see the Twilio docs on validating messages)..

In a recent audit, the use of sha1 was flagged as a potential problem.

As part of the explanation and justification for why it is OK to use hmac-with-sha1, Twilio pointed to this article about hmac with sha1, though I note that article is from 2009.

So, what say you crypto.stackexchange? Is it still safe in 2018 for an organization like Twilio to use sha1 in an HMAC?

$\endgroup$

marked as duplicate by Luis Casillas, Maarten Bodewes, Ella Rose, SEJPM Jul 24 '18 at 8:25

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • $\begingroup$ Yes, still secure, but they should migrate away none-the-less. If they say that this is impossible you can ask them to explain why it is impossible for them to upgrade the protocol and consequently what their upgrade strategy is. That question will probably make them sweat a bit :) $\endgroup$ – Maarten Bodewes Jul 24 '18 at 0:59

Browse other questions tagged or ask your own question.