# Is SHA-1 still practically secure under specific scenarios?

It is conjectured that SHA-1 has been broken from the "research" perspective but no in real world. That is that there is an algebraic attack that explores weaknesses on its algebraic construction. The same happens for MD5 but MD5 has been practically broken by finding collisions in real world. Can we still use HMAC with SHA-1 and be secure against preimage, second preimage and collisions?

• Are you talking about HMAC with a key that's unknown to the attacker? – CodesInChaos Feb 27 '13 at 19:41
• I wouldn't use SHA-1 in any situation where MD5 is broken i.e. when some form of collision resistance is required. – CodesInChaos Feb 27 '13 at 19:49
• @CodesInChaos Yes the key is unknown – curious Feb 28 '13 at 9:02

I would recommend phasing out SHA-1 in any scenario where collision-resistance of a hash is required, for there is a wide consensus that an attack with $2^{69}$ complexity would work, it would already be feasible by a resourceful entity, and attacks only get better.
Update: A collision for SHA-1 was published in February 2017 (4 years after this answer was written). It took an effort comparable to $2^{63}$ hashes (less than the $2^{69}$ consensual by 2013, but more than the $2^{61}$ of the best claimed theoretical approach, which turned out to have a few rough edges). The phasing out of the first paragraph has become a must. The second and third paragraph of the answer remain valid.