Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
At the current time, is SHA256 the de facto standard for strong cryptographic hashes?
From what I am seeing of more sites utilizing it, I would suppose the answer to this is yes, but would like to hear what the community here has to say about this and why it is happening.
Yes, SHA-256 is currently the de facto standard. The "why" is that MD5 and SHA-1 are unsafe and the only algorithm left which has been extensively studied and deployed and which nobody has found a significant attack against is SHA-256. (There is also SHA-512, but people seem to regard it as being overkill.)
There is widespread uncertainty about whether someone will discover an efficient attack on SHA-256 in the near future. It was this fear which motivated the SHA-3 competition.
You should also consider using a generic length-extension defense such as the "SHA-256d" design by Ferguson and Schneier. SHA256d(x) = SHA256(SHA256(x)). If you don't use a generic length-extension defense then you have to consider the consequences of length-extension attacks in each place that you use a hash function. Such considerations can be tricky, and if you misunderstand one, this can sometimes cause a security vulnerability. This is why it is safer to use a generic length-extension defense every time you use a hash function.
If for some reason you don't want to use SHA-256, and you don't want to use a new hash function such as a SHA-3 candidate, then you might also consider Tiger. It has the distinction of being one of the longest-serving hash functions for which there is no known practical attack. However, it has been seriously wounded (i.e. by impractical but theoretically significant attacks), and I would consider SHA-256 safer than Tiger at this point. If efficiency matters, Tiger is faster than SHA-256, SHA-1, or any SHA-3 finalist on 64-bit hardware. It doesn't come with generic length-extension defense built in, but you can of course define Tigerd(x) = Tiger(Tiger(x)).
I would also regard the current crop of SHA-3 finalists as very likely to be secure: http://ehash.iaik.tugraz.at/wiki/The_SHA-3_Zoo . They are much newer, of course, than SHA-256, but they were all designed with a thorough understanding of the flaws in MD5 and in SHA-1, and they have been subjected to intensive scrutiny for almost three years now. They all come with generic length-extension defenses. My favorites are Blake and Skein, which are faster than SHA-256 on Intel/AMD chips. Unfortunately all of the SHA-3 candidates are slower than SHA-256 on ARM chips.
Don't use MD5 or SHA-1. Please.
Yes, currently SHA256 is pretty much de facto standard strong cryptographical hash (with about the only real competition being SHA384/SHA512).
The reason for that, as far as I can tell, it the perceived lack of alternatives. When Ms. Wang published her attack, she managed to break the great majority of hash functions out there. A number of hash functions has been published since then; however, because of her attack, people have become cautious. SHA256 and SHA512 are cautious designed done by people who know what they are doing; there has also been some amount of analysis of SHA256 and SHA512. That appears to be better than any other design out there (at least, until the AHS winner is announced).
To add to @poncho's answer: SHA-256 is a Merkle-Damgård construction, quite similar to SHA-1 and MD5, only with many more internal operations. When the attacks on MD5 were first published, there was some fear that they could be extended to similar hash functions, and they were indeed applied to SHA-1, but with much less success (the attack is still theoretical, no actual collision has been computed). NIST decided to launch an open competition to standardize a new function, dubbed SHA-3; internal reasons were not disclosed but it is usually assumed that they wanted a replacement for SHA-2 in case SHA-2 was broken ("SHA-2" is the collective name for SHA-224, SHA-256, SHA-384 and SHA-512).
SHA-2 was not broken. It seems that after 2008, all progress on breaking SHA-1 or SHA-2 has stopped. Whether this is because SHA-2 is inherently robust, or because all apt researchers are busy with the SHA-3 candidates, is not known.
Once SHA-3 has been selected and a standard published (should have happened by the end of 2012), the new SHA-3 will become a serious alternative for SHA-256 (or so we hope; SHA-256 will still be faster than the new SHA-3 on most 32-bit architectures). In the meantime, SHA-256 is the recommended hash function for all new designs.
