9
$\begingroup$

I read SHA-1 is still a secured hashing function with no collision found as of now. However, it's just a matter of time for someone to come up with such a collision or attack. Therefore, in new projects, it is recommended to use SHA-256. SHA-512 is even better.

In Java, we still use the "SHA1PRNG" algorithm in the SecureRandom class for the purpose of generating IV (let's say for CBC).

Is SHA-1 secure enough as hash function within a PRNG to generate an unpredictable IV for CBC? Or is SHA-256 recommended, even for a PRNG?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
12
$\begingroup$

I read SHA1 is still a secured hashing function with no collision found as of now.

You read an old text, this is not the case anymore since SHA-1 was SHAttered.

In Java, we still use SHA1PRNG algorithm in SecureRandom class for the purpose of generating IV (let's say for CBC).

Is it enough secured as a PRNG generating unpredictable IV for CBC? Or even for a PRNG, SHA256 is recommended?

SHA-1 is still fine for key derivation, HMAC, MGF1 based padding and indeed random generation and many other use cases that do not suffer from collision attacks.

That said, attacks can only get better, never worse, so using a more modern hash is always recommended. When it comes to random number generation the seeding is much more likely to be problematic though, and you should definitely make sure that your systems RNG is running correctly.

And, when it comes to Java's SecureRandom, you may want to consider my answer on StackOverflow and not use (or at least indicate) "SHA1PRNG" at all.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Wrt this answer and your other, why then is SHA-1 SecureRandom still part of JDK 10? My conspiracy organ is aching... $\endgroup$
    – Paul Uszak
    Oct 17, 2018 at 20:55
  • 2
    $\begingroup$ Well, it is still secure. And if they remove it then all of the existing software that uses "SHA1PRNG" breaks. If they were out there to break your code they would not have supplied the more secure alternatives or SecureRandom.getInstanceStrong() I suppose. Heck, you can easily make a HSM or SmartCard provided random the default. Most other languages / libraries are way less flexible. Android used a bad implementation of SHA1PRNG and now simply lies if you try and use it, as everybody still hardcodes "SHA1PRNG" for some reason or other. $\endgroup$
    – Maarten Bodewes ♦
    Oct 17, 2018 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.