On July 11, 1994, the NIST proposed an interesting revision to FIPS 180, about the Secure Hash Standard:

A revision of Federal Information Processing Standard (FIPS) 180, Secure Hash Standard (SHS), is being proposed. This proposed revision corrects a technical flaw that made the standard less secure than had been thought. The algorithm is still reliable as a security mechanism, but [sic] the correction returns the SHS to the original level of security.

What was the technical flaw?

FIPS PUB 180-1, which specifies SHA-1, was published on 17 April, 1995. It superseded FIPS PUB 180, which was published on 11 May, 1993.

On the first page of FIPS PUB 180-1 it explains:

A circular left shift operation has been added to the specifications in section 7, line b, page 9 of FIPS 180 and its equivalent in section 8, line c, page 10 of FIPS180. This revision improves the security provided by this standard. The SHA-1 is based on principles similar to those used by Professor Ronald L. Rivest of MIT when designing the MD4 message digest algorithm 1, and is closely modelled [sic] after that algorithm.

Security was improved by the revision, but there is no explanation as to what the circular left shift remedied.

Does anyone know what the original flaw was?

  • 3
    $\begingroup$ Tthe intro in Xiaoyun Wang, Hongbo Yu ,Yiqun Lisa Yin's Efficient Collision Search Attacks on SHA-0, in proceedings of Crypto 2005, is all I know about the issue. Later attacks have improved on their results. $\endgroup$
    – fgrieu
    Feb 20, 2021 at 5:29


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.