I read SHA-1 is still a secured hashing function with no collision found as of now. However, it's just a matter of time for someone to come up with such a collision or attack. Therefore, in new projects, it is recommended to use SHA-256. SHA-512 is even better.
In Java, we still use the "SHA1PRNG"
algorithm in the SecureRandom
class for the purpose of generating IV (let's say for CBC).
Is SHA-1 secure enough as hash function within a PRNG to generate an unpredictable IV for CBC? Or is SHA-256 recommended, even for a PRNG?