Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [sha-1]

SHA-1 is a hash function that is two generations old, no longer considered secure for all uses and should only be used for backward compatibility.

Filter by
Sorted by
Tagged with
104 votes
2 answers
21k views

What is the new attack on SHA-1 "SHAttered" and how does it work?

There's a new recent Attack on SHA-1 named "SHAttered" by Google and some researchers. I understand that it uses some fancy new techniques, but not the details. My question is: How? How does the ...
SEJPM's user avatar
  • 46.1k
79 votes
1 answer
48k views

How easy is it in 2022 to find a SHA1 collision?

Most of the answers I can find date to years back where the first collision(s) were found, but hardware mainly GPUs have progressed a lot in the past few years (with for example the new line of 3090s ...
Hormoz's user avatar
  • 799
68 votes
2 answers
25k views

Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1?

I am from a web development background (I don't know an awful lot about cryptography or how the algorithms themselves work), so I am asking this question in simple terms. Consider a hash of the word '...
BadHorsie's user avatar
  • 813
52 votes
2 answers
15k views

Why is SHA-1 considered broken?

Is there a known pair of distinct bit strings (A,B) such that SHA-1(A) == SHA-1(B)? If the answer is no, then how can SHA-1 be considered broken?
Andrew Tomazos's user avatar
42 votes
2 answers
34k views

Are there any known collisions for the SHA (1 & 2) family of hash functions?

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512? By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?
Pacerier's user avatar
  • 1,265
39 votes
2 answers
59k views

Why is HMAC-SHA1 still considered secure?

This Q & A https://security.stackexchange.com/questions/33123/hotp-with-as-hmac-hashing-algoritme-a-hash-from-the-sha-2-family says that the security of HMAC-SHA1 does not depend on resistance to ...
user93353's user avatar
  • 2,245
37 votes
3 answers
8k views

Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?

Note: I am not advocating anyone continues using SHA1-signed certificates: they are dead as far as security is concerned and should no longer be used. I'm just trying to clarify my understanding of ...
TripeHound's user avatar
36 votes
2 answers
51k views

HMAC-SHA1 vs HMAC-SHA256

I have three questions: Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? How much HMAC-SHA256 is slower than HMAC-SHA1? Are the security improvements of SHA256 (over SHA1) enough to ...
Mario's user avatar
  • 361
35 votes
2 answers
28k views

How secure is SHA1? What are the chances of a real exploit?

I read that, in February 2017, a SHA1 collision was calculated for the first time. This, and earlier theoretical proof, means that SHA1 is officially cryptographicaly insecure. But, when using SHA1 in ...
Rob van Laarhoven's user avatar
32 votes
1 answer
87k views

How is SHA1 different from MD5?

On the surface, SHA1 and MD5 look pretty similar. Their diagrams include chunks of bits, bit rotation, xor and special functions. Their implementations are roughly the same length (at least the ones I'...
qwr's user avatar
  • 435
29 votes
1 answer
2k views

How are the functions used in cryptographic hash functions chosen?

I'm learning about cryptographic hash functions and I have some questions about the functions used in the compression function. MD5 uses the following functions: $f_{1}(B,C,D)=(B\wedge C)\lor(D\...
Cartman123's user avatar
28 votes
1 answer
3k views

What is hardened SHA-1, how does it work and how much protection does it offer?

From the shattered website: You can use the online tool above to submit files and have them checked for a cryptanalytic collision attack on SHA-1. The code behind this was developed by Marc Stevens ...
Maarten Bodewes's user avatar
24 votes
2 answers
14k views

Why initialize SHA1 with specific buffer?

SHA-1 is initialize with a specific buffer: h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0? Why?
juaninf's user avatar
  • 2,711
20 votes
4 answers
80k views

Does the SHA hash function always generate a fixed length hash?

I'm using the SHA1/2 family of algorithms for a particular project. I was wondering if all the SHA algorithms return a fixed length hash regardless of the length of the data.
Robin Rodricks's user avatar
18 votes
1 answer
12k views

In 2020, SHA-1 practically broken in chosen-prefix collision (CP-collision). Can double SHA-1 hashing prevent CP-collision?

In a recent study SHA-1 is a Shambles - First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust by Gaëtan Leurent and Thomas Peyrin. 2020, they showed the first practical chosen-...
kelalaka's user avatar
  • 48.8k
17 votes
3 answers
13k views

After Google's collision attack, is RSA-SHA1 signature still safe?

Google succeeded to get a collision in SHA-1 last year in an attack called shattered. Does this fact make certificates based RSA-SHA1 Signature risky for creating fraud certificates? If RSA-SHA1 ...
adi's user avatar
  • 175
15 votes
2 answers
6k views

How reassuring is 64-bit (in)security?

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity....
DannyNiu's user avatar
  • 9,409
15 votes
2 answers
4k views

Why do we append the length of the message in SHA-1 pre-processing?

As we know, SHA-1 is irreversible, so why do we append the length of the message to the preimage?
Am1rr3zA's user avatar
  • 755
14 votes
2 answers
11k views

Is PBKDF2-HMAC-SHA1 really broken?

I just read through this article which demonstrates practical (and seemingly trivial) collisions in PBKDF2-HMAC-SHA1, and provides a few examples of collisions. Am I missing something here? Is PBKDF2-...
Polynomial's user avatar
  • 3,527
14 votes
1 answer
2k views

Is Wikipedia's table about SHA-2 collisions correct?

I was looking a Wikipedia article on SHA-2, and the "Comparison of SHA functions" table seems to indicate that SHA-2 is less secure than SHA-1. Is this true, or is the table wrong / misleading? What ...
Luke's user avatar
  • 339
14 votes
2 answers
13k views

128 bit hash with least chance of collision?

I'm building a storage system for JSON documents where they are looked up on a 128 bit key. These JSON documents have a timestamp within them, but apart from that are user-entered data. These JSON ...
Max's user avatar
  • 275
13 votes
3 answers
14k views

In the SHA hash algorithm, why is the message always padded?

In the SHA hash algorithm the message is always padded, even if initially the correct length without padding; the padding is of the form "1" followed by the necessary number of 0s. Why is it ...
hihello4's user avatar
  • 131
12 votes
3 answers
11k views

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

SHA-1 and SHA-2 share the same structure and mathematical operation as their predecessors - SHA-0 and MD5. Both SHA-0 and MD5 have been broken. This is one of the main reasons why SHA-1 is considered ...
prakharjain's user avatar
12 votes
4 answers
31k views

Is it fair to assume that SHA1 collisions won't occur on a set of <100k strings

I'm building a system that has to take file paths, and generate a unique name for each one. I'm planning on using SHA1 as the hash function. My question is: do I have to deal with possible collisions ...
Denis Hennessy's user avatar
12 votes
2 answers
11k views

What are advantages of using a HMAC over RSA with SHA-1 hashes?

I am currently studying for an exam and this was a previous question: Give one advantage of using HMACs over using RSA to sign SHA-1 hashes. My thoughts are that it has something to do with the ...
Shane's user avatar
  • 223
12 votes
1 answer
355 views

Why doesn't Wang's attack work on SHA-1?

Wang's (et al) differential attack works on MD5, MD4, RIPEMD and HAVAL. Why doesn't it work on SHA-1?
Peppina's user avatar
  • 121
11 votes
2 answers
7k views

Why can't they just fix SHA-1 if it's broken?

Presently 160 bits of hash block width seems to provide adequate security against brute force attacks. The recent developments concerning SHA-1 have reduced the effort to force collisions by 5 orders ...
Paul Uszak's user avatar
  • 15.5k
11 votes
3 answers
5k views

Accelerating SHA-1

I have a program where computing SHA-1 is the bottleneck. This is using OpenSSL 1.0.0e on a 2.6Ghz 16-core Opteron where I get about 325MiB/s throughput. (SHA1 here is via Andy Polyakov's x86-64 ...
Fixee's user avatar
  • 4,158
11 votes
1 answer
2k views

Why are the initial states of hashes functions (like SHA-1) often non-zero?

There is already a question asking "Why initialize SHA1 with specific buffer?" and my question follows on from this: Why are the initial states of hash functions often non-zero? For most, I have ...
Cryptographeur's user avatar
10 votes
3 answers
6k views

How many bits in the resultant hash will change, if the x bits are changed in its the original input?

I came across a question stating: We have a message consisting of 10,000 characters. After computing its message digest using SHA-1, we decide to change the last 19 characters in the original message....
Vasu Deo.S's user avatar
10 votes
3 answers
6k views

Advantages/disadvantages of using symmetric encryption function as hash function?

Next to the traditional MD5 and SHA-1, other hashing algorithms exist based on symmetric encryption algorithms. An example is the Matyas–Meyer–Oseas construction. What are the advantages/...
John's user avatar
  • 105
9 votes
1 answer
4k views

How hard is it to generate a simultaneous MD5 and SHA1 collision?

I was recently reading that MD5 is "broken" because it's pretty easy to generate collisions (like 2^(L/2)). And the SHA1 (theoretically) fares no better. The ...
xyz's user avatar
  • 455
9 votes
3 answers
3k views

SHA-1 collisions - what about practical attacks?

I understand the theoretical problem with hash collision but when it comes to practice, I get very confused. Suppose a attacker would like to forge a certificate (or any kind of structured piece of ...
crypto-learner's user avatar
9 votes
1 answer
5k views

Is SHA-1 secure when used to implement a PRNG

I read SHA-1 is still a secured hashing function with no collision found as of now. However, it's just a matter of time for someone to come up with such a collision or attack. Therefore, in new ...
Saptarshi Basu's user avatar
9 votes
1 answer
231 views

What was the NSA's reasoning for making their bitwise combination functions in SHA-1 the way they did?

I know that these functions are there to actually make the program work. What I want to know is why they made the functions one way but not another. For example, why did they pick F1(B, C, D) = (B &...
BonBon's user avatar
  • 101
9 votes
1 answer
2k views

Outlook of trustworthiness of SHA-2

On the Wikipedia page of SHA-2, the following is written: Currently, the best public attacks break preimage resistance for 52 out of 64 rounds of SHA-256 or 57 out of 80 rounds of SHA-512, and ...
matthias_buehlmann's user avatar
9 votes
1 answer
3k views

Is HMAC-SHA-1 secure?

Although SHA-1 theoretically has collisions, HMAC-SHA-1 which is based on SHA-1 is still widely used (in TLS for example) and is considered to be secure. How is that possible?
BlaX's user avatar
  • 736
9 votes
1 answer
1k views

Why does SHA-1 rotate the variables A and B?

SHA-1 has an operation within round j in stage t, where the functions $f_t$ and $K_t$ change depending on the stage. Is there a specific reason why the variable $A$ is rotated by 5? How does this ...
Cartman123's user avatar
9 votes
4 answers
2k views

Hashing a password before using for online accounts

I don't actually know what I'm talking about, so apologies if I get anything wrong. At the moment I have a password naming system for most of my online accounts that looks something like this: ...
jerboa88's user avatar
  • 193
9 votes
2 answers
12k views

How long should a HMAC cryptographic key be?

In the top answer to this question the answerer says 'with a sufficently long key'. I am using a SHA1-HMAC (may switch to SHA256-HMAC) algorithm to verify cookies sent to clients as authentication ...
Adam Griffiths's user avatar
9 votes
1 answer
6k views

SHA1 no longer considered secure for SSL Certificates -- what about Cipher Suites?

Many browsers and Internet companies have recently claimed that SSL Certificates with a signature algorithm of SHA1 will imminently no longer be considered secure. Most notably, Google and Google ...
Eddie's user avatar
  • 983
9 votes
1 answer
5k views

What is the use of SCRAM-SHA-256 (over SCRAM-SHA-1)?

The Salted Challenge Response Authentication Mechanism (SCRAM) specified in RFC 5802 can use arbitrary hash functions to operate. The base version from RFC 5802 uses SHA-1. From my understanding, ...
Jonas Schäfer's user avatar
8 votes
3 answers
7k views

How to get an output of SHA-1 with first 2-bit are zeros?

Can someone explain what are the ways to get an output of SHA-1 with first 2-bits which are zeros?
Denver1212's user avatar
8 votes
6 answers
1k views

How can I improve a password generation scheme based on a shared secret and URL?

I currently use the following method to generate a different password on every website I have to login: password = SHA1 ( mainPassword . domainName . number ) ...
yogsototh's user avatar
  • 183
8 votes
2 answers
2k views

SHA-1 – Why is it hard to find a certificate collision?

Why is it it’s so much harder to execute a successful collision on certificates than it is on text data? I assume this has to do with the fact the certificate actually is a file that contains signed (...
Eagle Creek's user avatar
8 votes
3 answers
8k views

Why does Openssh use only SHA1 for signing and verifying of digital signatures?

I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh ...
Rakesh Gupta's user avatar
8 votes
1 answer
422 views

Would finding a Merkle-Damgård preimage that doesn't change the initial state allow an attacker to prepend it to any hashed message?

Suppose, a message M was found so that MD5(M) = S, where S is the initial state of the MD5 function (0x01234567, ...). Given a hash MD5(m), would this allow computing MD5(M∥m∥padding), where padding ...
Mark's user avatar
  • 835
8 votes
1 answer
637 views

How did SHA-1 'feed' Blum Blum Shub

One of the most (in)famous hardware derived random number generators was Lavarand (patent). It did it with funky lava lamps. An image of the lamps was hashed and fed into Blum Blum Shub (BBS) to ...
Paul Uszak's user avatar
  • 15.5k
7 votes
2 answers
5k views

Does a hash function have a Upper bound on input length?

I came across this Answer stating (just a line from the answer):- The input space is "infinite" and thus it has an infinite amount of values that will collide into a single hash And in the ...
Vasu Deo.S's user avatar
7 votes
3 answers
5k views

Is Base64(SHA1(GUID)) still unique like the original GUID?

Basically what the title is; GUIDs are unique by design. If you run the GUID through SHA1 and then Base64 the hash, will the resulting string have the same guaranteed uniqueness as the GUID, or not?
John's user avatar
  • 173

1
2 3 4 5 6