Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sha-1]

SHA-1 is a hash function that is two generations old, no longer considered secure for all uses and should only be used for backward compatibility.

0
votes
1answer
47 views

Unable to reproduce correct signature data

"Skatteetaten" is the Norwegian tax authority. We're currently trying to implement signing of messages for digital cash registry systems and i'm not able to reproduce the desired signed data. Went ...
1
vote
0answers
13 views

GlobalSign cert in Trusted root for Google Services shows Sha1. Security postures

"GlobalSign" certificate in Trusted Root Certification Authorities for Google Services shows Sha1. Security postures are different than just 2-3 yr ago. At my home, router bought 2016, networked; ...
2
votes
3answers
113 views

Changing SHA-1 constants an functions: Does it affect security?

I have been looking into the SHA-1 algorithm. I found that there are a set of functions and constants in the algorithm that have been standardized (section 5 of RFC 3174). If I want to use SHA-1, ...
9
votes
2answers
1k views

How reassuring is 64-bit (in)security?

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity....
3
votes
1answer
199 views

Is SHA1 secured enough as a PRNG

I read SHA1 is still a secured hashing function with no collision found as of now. However, it's just a matter of time for someone to come up with such a collision or attack. Therefore, in new ...
1
vote
0answers
26 views

Nature of risk(s) from KeeChallenge XML file stored in cloud at Onedrive

As a noob user of KeePass2 on Windows desktop and Keypass2Android on my phone, supplemented by YubiKey Neo configured for hmac-sha1 challenge response, I noticed that Keepass2Android appears to store ...
2
votes
0answers
99 views

Is it possible to prevent length extension attacks

Is it possible to prevent length extension attacks without using any other hash algorithm than SHA-1?
0
votes
0answers
67 views

Understanding how SHA-1 works [duplicate]

I want to understand how SHA-1 works and I found this site https://www.cryptocompare.com/coins/guides/how-does-a-hashing-algorithm-work/ If you have a look at this link, in step 1, they create 5 ...
1
vote
0answers
79 views

Is it still safe to use sha1 as an hmac hash function in 2018 [duplicate]

I'm curious if it's safe to use sha1 for an HMAC in 2018 in a platform product. A popular vendor (Twilio) uses an HMAC with sha1 with a shared secret to validate that messages they send are indeed ...
27
votes
3answers
3k views

Does “Shattered” actually show SHA-1-signed certificates are “unsafe”?

Note: I am not advocating anyone continues using SHA1-signed certificates: they are dead as far as security is concerned and should no longer be used. I'm just trying to clarify my understanding of ...
17
votes
3answers
7k views

After Google's collision attack, is RSA-SHA1 signature still safe?

Google succeeded to get a collision in SHA-1 last year in an attack called shattered. Does this fact make certificates based RSA-SHA1 Signature risky for creating fraud certificates? If RSA-SHA1 ...
0
votes
2answers
144 views

Fastest way to compute iterates of SHA1

It's well-known that computing lots of hash functions (like SHA1) in parallel involves the use of GPUs in most cases. However, when doing something serially, such as computing ...
0
votes
2answers
106 views

TLS1.2 AES 128 CBC Encrypted Data size is not a multiple of block size [closed]

I know that TLS ciphers such as TLS_RSA_WITH_AES_128_CBC_SHA transmit data as shown https://tools.ietf.org/html/rfc5246#section-6.2.3.2. From my understanding the ciphertext MUST be a multiple of the ...
1
vote
4answers
570 views

Can SHA or MD5 results be decrypted?

I have learned that SHA-1 and MD5 are one way hash functions, which means that it is not possible to obtain the original value by performing the reverse calculation. There however some online ...
0
votes
0answers
38 views

constructing collisions in SHA0 and SHA1

I study paper about constructing collisions in SHA family for better understanding of so called local collisions. On page 60 authors explain their method on truncated SHA0 - SHI1, where operation ADD ...
2
votes
1answer
160 views

local collisions in SHA 0

I have found interesting for me paper about constructing collisions in SHA 0. On page 60 the author determines M variable which is a concatenation of 32-bits vectors $M^{(i)}$, but I can't find any ...
3
votes
1answer
80 views

Statistical attacks on a list of MD5/SHA-1 hashes?

I have a list of MD5 and SHA-1 hashes where the input string is of the form secret1000 secret1001 … all the way up to ...
3
votes
1answer
86 views

Birthday problem applied to hash function with partition of the input set

I am not able to understand why if we consider a regular hash function, it is possible to say that we are partitioning the starting set and then apply the the birthday paradox/problem. Can anyone ...
1
vote
1answer
86 views

Backward Expansion of SHA1

Given a SHA1 hash, is it now possible to "practically" find the source material that was passed through SHA1 now that the Shattered paper has produced the first "practical" collision? As a follow on ...
1
vote
1answer
34 views

Expanding truly random key into printable password for successive hashing

The STUN network protocol defines its client authorization in the terms of message-integrity check employing the following scheme [RFC5389, section 10.2]: $$ \DeclareMathOperator{\HMAC}{HMAC} \...
1
vote
2answers
106 views

Purpose of folding a digest in half

The Linux kernel's random driver generates randomness by hashing an entropy pool using SHA-1. From the driver's source, the SHA-1 hash is apparently folded in half before being returned: ...
1
vote
2answers
265 views

Optimal way to bind two hashes

Currently I have: H1 = SHA256 H2 = SHA1 Both H1 and H2 have fixed length. What's the most efficient way to bind H1 and H2 together into H3? The goal is to ...
1
vote
1answer
148 views

Difficulty of generating a string “The (md5|sha1) hash of this string is (x)” that hashes to (x) vs. regular hash collision between files?

I know that collisions in md5 and sha1 have been demonstrated in particular pairs of files (by incrementing some none viewable portion of a PDF, etc). Would generating the above string be ...
2
votes
1answer
107 views

Why does FIPS-180-4 require the final padding block start with a 1?

From FIPS-180-4 § 5.1.1, the padding used for the SHA family of hashes begins with a binary 1, followed by a number of 0s, and finally a 64-bit representation of the message length: Suppose that the ...
2
votes
2answers
439 views

HMACSHA1 vs HMACSHA2 (for PBKDF2)

I need to choose an HMAC function for PBKDF2. I'm using .net so I don't have the option to use SHA3. At first glance, and according to this answer by Thomas Pornin it seems like SHA512 would be best....
2
votes
1answer
37 views

Input existence proof for known partial input and hash

Let $h$ signify the hash (Merkle–Damgård construction) generated from some input of known length $n$. Given $h$ and an input $k$ of length $n_1$, is there a way to prove that there exists (does not ...
0
votes
1answer
165 views

Interpreting the Hash type in a TLS ciphersuite

There are ciphersuites with SHA256, and SHA384. In the following TLS ciphersuite, the SHA types is not specified. Does this always refer to SHA1 (there is SHA0 as well) so which one of them? ...
2
votes
0answers
59 views

*feasible* pre-image attacks against reduced SHA-1

(tldr: see last paragraph) Although SHA-1 is vulnerable to collision attacks, it is still resistant to pre-image attacks. SHA-1 was designed to be resistant until a brute-force attack of $2^{160}$ is ...
1
vote
1answer
94 views

Cut through mode for TLS AES-CBC / SHA ciphersuite

I am looking at RFC5246 and it seems that AES-CBC/SHA cipher suites cannot be implemented in a cut-through mode. Let's suppose that received record spans two segments. As i understood HMAC ...
0
votes
1answer
106 views

What to do with a last chunk of 503 bits in SHA1?

I was trying to implement a SHA1 algorithm last night, and I got stuck at preprocessing the chunks in SHA1. As I have understood it, the message that has to be hashed, has to be broken into chunks of ...
-1
votes
1answer
222 views

How many time does a SHA-1 computation require on modern CPU/GPU? [closed]

I am considering how long a SHA-1 computation will need on modern CPU/GPU's. Just in case we are interested in brute forcing and consider the birthday paradoxon, then we need consider the SHA-1 output ...
6
votes
2answers
369 views

Does a practical collision attack on a cryptographic hash function also mean it fails “indistinguishable from random data”?

It is knowns that SHA-1 has been broken in practice using collision attacks. Related to SHA-1 this mainly had a negative impact on the security of Digital Certificate signatures Email PGP/GPG ...
8
votes
1answer
281 views

Would finding a Merkle-Damgård preimage that doesn't change the initial state allow an attacker to prepend it to any hashed message?

Suppose, a message M was found so that MD5(M) = S, where S is the initial state of the MD5 function (0x01234567, ...). Given a hash MD5(m), would this allow computing MD5(M∥m∥padding), where padding ...
-1
votes
1answer
27 views

Can private hashing techniques be used in MySql 2000 server ? Help me decode this? [closed]

So last night my father gave me my birthday challenge. He made a website and asked me to get admin access there. I don't have any XSS knowledge, so I started with SQL Injection. I tried using SqlMap ...
1
vote
0answers
114 views

does SHA* collide more or less than a random function?

There were several questions here regarding how surjective SHA-1/2 is, how many values don't have a pre-image from a fixed size input. I and others answered when modelling the relevant hash function ...
2
votes
1answer
189 views

Prove you computed $hash^r(input)$ for some cryptographic hash function

What is the most efficient way to prove that a person computed $r$ rounds of some cryptographic hash function (ex. SHA256) on an input? Specifically, I'm trying to optimize (1) the running time of the ...
4
votes
1answer
315 views

Does still make sense to use SHA1?

I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying ...
2
votes
1answer
887 views

What makes a hash like SHA1 resistant to collisions?

I have been reading about SHA1 and SHA256 and how they actually hash a string of text to a unique hashed message. But what I dont understand is what makes them resistant to collisions. Whats the ...
21
votes
2answers
6k views

How secure is SHA1? What are the chances of a real exploit?

I read that, in February 2017, a SHA1 collision was calculated for the first time. This, and earlier theoretical proof, means that SHA1 is officially cryptographicaly insecure. But, when using SHA1 in ...
3
votes
1answer
993 views

What does “bits” mean in the context of hash functions?

What does the "bits" in hash functions mean? I started studying hash functions but I still do not understand what the bits means. What does it mean to say that MD5 is 128-bits or that SHA-1 is 160 ...
3
votes
1answer
179 views

Would the Intel SHA extensions help in creating SHA1 collisions?

Would the Intel SHA extensions help in creating SHA1 collisions? AMD Ryzen and EPYC supports them.
0
votes
1answer
461 views

What is the length of the SHA-1 message digest and how is RSASSA-PSS used for verification?

I am a newbie to cryptography and SHA-1. Currently I am configuring a SHA-1 hash function which takes default length as 128 bits. Is it okay to configure it this way, since I see in most cases SHA-1 ...
-3
votes
1answer
155 views

Help in decrypting this message: “e811339cf0258d2977fdefcd110c0e17daa5de81”? [closed]

Here are some details: I was given was a text that was converted into hexadecimal, then hashed via MD5, then hashed via SHA-1. That’s all I know about it. Any help is really appreciated. There is ...
6
votes
1answer
2k views

Is PBKDF2/RFC 2898 broken because SHA1 is broken?

I was attempting to re-implement the ASP.NET Identity password hash algorithm in PHP. It uses RFC 2898, which uses HMAC SHA1. SHA1 has been broken by google. Does this mean that RFC 2898 in general ...
10
votes
2answers
7k views

Why can't they just fix SHA-1 if it's broken?

Presently 160 bits of hash block width seems to provide adequate security against brute force attacks. The recent developments concerning SHA-1 have reduced the effort to force collisions by 5 orders ...
1
vote
1answer
470 views

openssl sha1 message digest not matching with NIST vector input?

When I call openssl sha1 from the command line echo "00" | xxd -r -p | openssl dgst -sha1 the output I am receive is ...
5
votes
1answer
196 views

How did SHA-1 'feed' Blum Blum Shub

One of the most (in)famous hardware derived random number generators was Lavarand (patent). It did it with funky lava lamps. An image of the lamps was hashed and fed into Blum Blum Shub (BBS) to ...
5
votes
2answers
147 views

usefulness of a collision attack that's not also a 2nd pre-image attack

So my understanding is that if we've got some hash function $H$ then a 2nd pre-image attack is one where given a message-hash pair $(m, H(m))$ we can find some $m' \neq m : H(m') = H(m)$, while a ...
4
votes
2answers
187 views

Does “SHAttered” only work for PDF files?

It appears that SHA-1 is broken in practice. The website detailing this attack shows an infographic of how two PDF files can have the same SHA-1 hash value. Also Google's. I've also read Mathew's ...
2
votes
1answer
234 views

SHA-1 collisions with RSA signatures

Could you confirm whether my understanding of the SHA-1 collision issue is correct? If for certificate $A$, the message digest equals to $X$ and a Root CA signs it with its private key everyone can ...