It is conjectured that SHA-1 has been broken from the "research" perspective, but not in the real world; that is, there exists an algebraic attack that explores weaknesses on its algebraic construction. The same happens for MD5, but MD5 has been practically broken by finding collisions in the real world. Can we still use HMAC with SHA-1 and be secure against preimage, second preimage and collisions?
$\begingroup$
$\endgroup$
3
-
$\begingroup$ Are you talking about HMAC with a key that's unknown to the attacker? $\endgroup$– CodesInChaosCommented Feb 27, 2013 at 19:41
-
1$\begingroup$ I wouldn't use SHA-1 in any situation where MD5 is broken i.e. when some form of collision resistance is required. $\endgroup$– CodesInChaosCommented Feb 27, 2013 at 19:49
-
$\begingroup$ @CodesInChaos Yes the key is unknown $\endgroup$– curiousCommented Feb 28, 2013 at 9:02
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
I would recommend phasing out SHA-1 in any scenario where collision-resistance of a hash is required, for there is a wide consensus that an attack with $2^{69}$ complexity would work, it would already be feasible by a resourceful entity, and attacks only get better.
I'm still confident that SHA-1 is preimage and second-preimage resistant for all practical purposes in the foreseeable future, when its full output is used. Nevertheless, I would prefer SHA-256 or RIPEMD-160 when they are possible options.
I'm still confident that HMAC with SHA-1 is secure in any scenario where HMAC's key is assumed secret, for all practical purposes in the foreseeable future; this is because an improved security argument for HMAC remains valid with weak assumptions on the underlying (round function of the) hash. I could recommend it in a MAC application where using a tarnished name is not an issue, and speed matters.
Update: A collision for SHA-1 was published in February 2017 (4 years after this answer was written). It took an effort comparable to $2^{63}$ hashes (less than the $2^{69}$ consensual by 2013, but more than the $2^{61}$ of the best claimed theoretical approach, which turned out to have a few rough edges). The phasing out of the first paragraph has become a must. The second and third paragraph of the answer remain valid.
-
2$\begingroup$ I think it should be mentioned that the security guarantees given by that HMAC-paper is disputed. See Another Look at HMAC and the youtube presentation Another look at provable security. While controversial, they do bring up relevant points to the practical (security) merit of the Bellare paper. $\endgroup$– hakojaCommented Feb 28, 2013 at 9:47
-
1$\begingroup$ @hakoja: Good point. On my first (aborted) reading of the paper some time ago, I concluded that the points raised against Bellare's proof, while valid and interesting, have no impact on practical security (that's acknowledged; see note following theorem 1). Some of Bellare's proof is even improved. Another point raised seems to be that HMAC should not be used with short keys in a settings with many users, because there's an attack of cost inversely proportional to the number of users; this applies to many cryptosystems, and does not change that we can have high confidence in HMAC. $\endgroup$– fgrieu ♦Commented Feb 28, 2013 at 12:31
-
$\begingroup$ The best collision attack on SHA-1 is Marc Stevens' attack which has a complexity of between 2^60.3 and 2^65.3 $\endgroup$ Commented Aug 13, 2015 at 22:48