# Why did the NSA create SHA?

new to cryptography, i'm trying to learn the program veracrypt, and i'm now trying to understand the history of hash functions and how it applies to veracrypt.

so this is what i understand so far, the NSA made SHA2, which is one of the hash functions that veracrypt can use for it's "key derivation function" and the NSA made SHA2 because they wanted an improvement on SHA1, and they made SHA1 because they wanted an improvement on SHA0.

what i don't understand is, why did NSA make SHA0 in the first place? and when did hash functions start being used for password storing and "key derivation functions"?

did hash functions start with the need for network security for verifying package? or did they start with the need of hashing passwords or both or what was the deal?

thanks!

• Because the USA government asks to do it! – kelalaka Mar 29 at 11:56
• Hash functions such as SHA-x must not directly be used for password storing. We need a purposely-slow password-basked key derivation function for that. – fgrieu Mar 29 at 21:05

The NSA created SHA (quickly replaced by SHA-1 to fix a security issue that remained unpublished for years) because they/the US government needed a 160-bit hash function, so that it has 80-bit security against collision-resistance, in particular towards use in the DSA signature system of FIPS 140.

In this usage, a hash functions condenses a possibly large piece of information $$m$$ (e.g. a 10MB file) into a smaller, easier to manipulate piece of information $$h=H(m)$$ (20 bytes for SHA-1), wich is what really gets signed. The hash must be collision-resistant, so that an adversary can't come with two distinct messages $$m$$ and $$m'$$ with $$H(m)=H(m')$$, which would allow the adversary to obtain a signature for $$m$$ from a legitimate signer, and pass it as the signature for $$m'$$.

SHA-1 uses principles similar to the earlier 128-bit MD5, but with a more regular design. Also it is big-endian, likely because that's customary (to the point of being unstated) in NIST crypto standards including DES/FIPS 43.

This question is asking a bunch of things, I will try to sort things out. Hash functions were around long before SHA-0. The popular hash before SHA-1 was MD5 which shares a lot with SHA0-2 but there were many others.

The SHA family were designed as part of a project trying to supply a full set of standardized cryptographic tools providing 80 bit security: https://en.wikipedia.org/wiki/Capstone_(cryptography)

They published SHA (now named SHA-0) and immidiatly retracted it due to a serious flaw and published SHA-1 instead. As computers grew stronger and cryptanalsis better,we needed a stronger hash functions. 80 bits of security doesn't seem all the great, so without being too creative the SHA2 family came out. This is essentially a supersized SHA-1.

Fast forward a few years, SHA-1 is still the most popular hash function, serious weaknesses emerge and computers keep getting faster. The Merkle-Damgard constuction also looses favor following attacks on the construction itslef.

Following the success of the AES competion, the SHA-3 competition is launched, and eventually the SHA-3 algorithm is standardized using a very different sponge construction and is hoped to remain secure for many years.

Key derivation functions are not the same as hash functions, and though using something like PBKDF2 we can convert a general purpose hash function to a KDF one should NOT use a general purpose hash function as KDF as is, for the simple reason general purpose hash functions (such as SHA*) are way too fast, and KDF are required to be slow.

Early hash functions were used for message digest, not sure exactly what came when. MD2 is from 1989 not sure what came before it. Password hashing, the earliest I know is Unix crypt based on the DES cipher from 1973. You can look at as a hash function but it didn't do compression it was 56 bits and 64 bits out.

Note, this answer is short and a mix of historical information and opinion, covering only the first half of your question, as the 2nd half deserves its own.

SHA0 and the Secure Hash Standard was created because the NSA was asked to develop cryptographic standards meeting an 80-bit security level for government and the American public, which would be provided for free (in comparison to say, RSA Security (the company)), but require the government to be in charge of the keys.

SHA1 was a revision to SHA0 after it was determined there was a flaw in the compression function which reduced the security.

The project failed to take hold, but the hash and signature algorithm became very successful standards as they were essentially independent of the key management and symmetric encryption standards (like Skipjack) of the project.

Later, during the process leading up to the AES competition, it became clear that hash algorithms matching the security level of the new cipher would be needed, and the NSA was tasked with creating the new algorithms, which followed the design of SHA1 but were significantly stronger with a more complex design.