Skip to main content

Questions tagged [sha-1]

SHA-1 is a hash function that is two generations old, no longer considered secure for all uses and should only be used for backward compatibility.

Filter by
Sorted by
Tagged with
15 votes
2 answers
7k views

How reassuring is 64-bit (in)security?

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity....
DannyNiu's user avatar
  • 9,422
39 votes
2 answers
59k views

Why is HMAC-SHA1 still considered secure?

This Q & A https://security.stackexchange.com/questions/33123/hotp-with-as-hmac-hashing-algoritme-a-hash-from-the-sha-2-family says that the security of HMAC-SHA1 does not depend on resistance to ...
user93353's user avatar
  • 2,245
10 votes
1 answer
4k views

How hard is it to generate a simultaneous MD5 and SHA1 collision?

I was recently reading that MD5 is "broken" because it's pretty easy to generate collisions (like 2^(L/2)). And the SHA1 (theoretically) fares no better. The ...
xyz's user avatar
  • 465
52 votes
2 answers
15k views

Why is SHA-1 considered broken?

Is there a known pair of distinct bit strings (A,B) such that SHA-1(A) == SHA-1(B)? If the answer is no, then how can SHA-1 be considered broken?
Andrew Tomazos's user avatar
104 votes
2 answers
21k views

What is the new attack on SHA-1 "SHAttered" and how does it work?

There's a new recent Attack on SHA-1 named "SHAttered" by Google and some researchers. I understand that it uses some fancy new techniques, but not the details. My question is: How? How does the ...
SEJPM's user avatar
  • 46.1k
37 votes
3 answers
8k views

Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?

Note: I am not advocating anyone continues using SHA1-signed certificates: they are dead as far as security is concerned and should no longer be used. I'm just trying to clarify my understanding of ...
TripeHound's user avatar
18 votes
1 answer
12k views

In 2020, SHA-1 practically broken in chosen-prefix collision (CP-collision). Can double SHA-1 hashing prevent CP-collision?

In a recent study SHA-1 is a Shambles - First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust by Gaëtan Leurent and Thomas Peyrin. 2020, they showed the first practical chosen-...
kelalaka's user avatar
  • 49k
36 votes
2 answers
51k views

HMAC-SHA1 vs HMAC-SHA256

I have three questions: Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication? How much HMAC-SHA256 is slower than HMAC-SHA1? Are the security improvements of SHA256 (over SHA1) enough to ...
Mario's user avatar
  • 361
24 votes
2 answers
14k views

Why initialize SHA1 with specific buffer?

SHA-1 is initialize with a specific buffer: h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0? Why?
juaninf's user avatar
  • 2,711
4 votes
1 answer
14k views

How is input message for SHA-2 padded?

I read about how is an input message prepared to be hashed by MD4,MD5 or SHA-1: Step1 Append padding bits The input message is "padded" (extended) so that its length (in bits) equals to 448 ...
yak's user avatar
  • 233
68 votes
2 answers
25k views

Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1?

I am from a web development background (I don't know an awful lot about cryptography or how the algorithms themselves work), so I am asking this question in simple terms. Consider a hash of the word '...
BadHorsie's user avatar
  • 813
9 votes
1 answer
6k views

SHA1 no longer considered secure for SSL Certificates -- what about Cipher Suites?

Many browsers and Internet companies have recently claimed that SSL Certificates with a signature algorithm of SHA1 will imminently no longer be considered secure. Most notably, Google and Google ...
Eddie's user avatar
  • 983
8 votes
3 answers
8k views

Why does Openssh use only SHA1 for signing and verifying of digital signatures?

I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh ...
Rakesh Gupta's user avatar
8 votes
3 answers
8k views

How to get an output of SHA-1 with first 2-bit are zeros?

Can someone explain what are the ways to get an output of SHA-1 with first 2-bits which are zeros?
Denver1212's user avatar
17 votes
3 answers
13k views

After Google's collision attack, is RSA-SHA1 signature still safe?

Google succeeded to get a collision in SHA-1 last year in an attack called shattered. Does this fact make certificates based RSA-SHA1 Signature risky for creating fraud certificates? If RSA-SHA1 ...
adi's user avatar
  • 175
11 votes
1 answer
2k views

Why are the initial states of hashes functions (like SHA-1) often non-zero?

There is already a question asking "Why initialize SHA1 with specific buffer?" and my question follows on from this: Why are the initial states of hash functions often non-zero? For most, I have ...
Cryptographeur's user avatar
9 votes
1 answer
3k views

Is HMAC-SHA-1 secure?

Although SHA-1 theoretically has collisions, HMAC-SHA-1 which is based on SHA-1 is still widely used (in TLS for example) and is considered to be secure. How is that possible?
BlaX's user avatar
  • 736
6 votes
2 answers
572 views

What is the complexity of finding SHA-1 collisions?

Given the recent news about SHA-1 collisions, what is the complexity of finding a SHA-1 collision? Marc Steven's HashClash is still detailing about 260. Does the previous complexity still hold?
user avatar
5 votes
2 answers
4k views

What does "message schedule" mean in SHA-256?

I am trying to understand the sha-256 algorithm from FIPS 180-2. I understood the padding and parsing of the message string. However after that it states (page 15): For $i = 1$ to $N$: { ...
Developer Android's user avatar
42 votes
2 answers
34k views

Are there any known collisions for the SHA (1 & 2) family of hash functions?

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512? By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?
Pacerier's user avatar
  • 1,265
28 votes
1 answer
3k views

What is hardened SHA-1, how does it work and how much protection does it offer?

From the shattered website: You can use the online tool above to submit files and have them checked for a cryptanalytic collision attack on SHA-1. The code behind this was developed by Marc Stevens ...
Maarten Bodewes's user avatar
  • 93.2k
20 votes
4 answers
81k views

Does the SHA hash function always generate a fixed length hash?

I'm using the SHA1/2 family of algorithms for a particular project. I was wondering if all the SHA algorithms return a fixed length hash regardless of the length of the data.
Robin Rodricks's user avatar
14 votes
2 answers
11k views

Is PBKDF2-HMAC-SHA1 really broken?

I just read through this article which demonstrates practical (and seemingly trivial) collisions in PBKDF2-HMAC-SHA1, and provides a few examples of collisions. Am I missing something here? Is PBKDF2-...
Polynomial's user avatar
  • 3,527
13 votes
3 answers
14k views

In the SHA hash algorithm, why is the message always padded?

In the SHA hash algorithm the message is always padded, even if initially the correct length without padding; the padding is of the form "1" followed by the necessary number of 0s. Why is it ...
hihello4's user avatar
  • 131
9 votes
3 answers
3k views

SHA-1 collisions - what about practical attacks?

I understand the theoretical problem with hash collision but when it comes to practice, I get very confused. Suppose a attacker would like to forge a certificate (or any kind of structured piece of ...
crypto-learner's user avatar
8 votes
2 answers
2k views

SHA-1 – Why is it hard to find a certificate collision?

Why is it it’s so much harder to execute a successful collision on certificates than it is on text data? I assume this has to do with the fact the certificate actually is a file that contains signed (...
Eagle Creek's user avatar
7 votes
2 answers
822 views

Does a practical collision attack on a cryptographic hash function also mean it fails “indistinguishable from random data”?

It is knowns that SHA-1 has been broken in practice using collision attacks. Related to SHA-1 this mainly had a negative impact on the security of Digital Certificate signatures Email PGP/GPG ...
e-sushi's user avatar
  • 17.9k
7 votes
2 answers
5k views

Does a hash function have a Upper bound on input length?

I came across this Answer stating (just a line from the answer):- The input space is "infinite" and thus it has an infinite amount of values that will collide into a single hash And in the ...
Vasu Deo.S's user avatar
7 votes
1 answer
832 views

Is SHA-1 still practically secure under specific scenarios?

It is conjectured that SHA-1 has been broken from the "research" perspective, but not in the real world; that is, there exists an algebraic attack that explores weaknesses on its algebraic ...
curious's user avatar
  • 6,180
1 vote
1 answer
823 views

SHA1 collision event probability after n iterations

There are String1 and String2 - some variables-strings. The probability of collision for different ...
Haradzieniec's user avatar
0 votes
1 answer
504 views

Does SHA-1 hash have quasi commutative property? [closed]

Although I have tested with a program and found negative answer, I want to be sure.
Hassan's user avatar
  • 51
-3 votes
1 answer
178 views

cipherText = aes-ctr(key, iv+1, (plainText)); & authTag= aes-ctr(key, iv, aes-ecb(key, sha-1(cipherText+authData+key+iv))); is it secure? [closed]

Proposed Cipher suite (using aes-ecb): ...
NKaran's user avatar
  • 5
35 votes
2 answers
28k views

How secure is SHA1? What are the chances of a real exploit?

I read that, in February 2017, a SHA1 collision was calculated for the first time. This, and earlier theoretical proof, means that SHA1 is officially cryptographicaly insecure. But, when using SHA1 in ...
Rob van Laarhoven's user avatar
29 votes
1 answer
2k views

How are the functions used in cryptographic hash functions chosen?

I'm learning about cryptographic hash functions and I have some questions about the functions used in the compression function. MD5 uses the following functions: $f_{1}(B,C,D)=(B\wedge C)\lor(D\...
Cartman123's user avatar
14 votes
2 answers
13k views

128 bit hash with least chance of collision?

I'm building a storage system for JSON documents where they are looked up on a 128 bit key. These JSON documents have a timestamp within them, but apart from that are user-entered data. These JSON ...
Max's user avatar
  • 275
11 votes
3 answers
5k views

Accelerating SHA-1

I have a program where computing SHA-1 is the bottleneck. This is using OpenSSL 1.0.0e on a 2.6Ghz 16-core Opteron where I get about 325MiB/s throughput. (SHA1 here is via Andy Polyakov's x86-64 ...
Fixee's user avatar
  • 4,168
10 votes
3 answers
6k views

How many bits in the resultant hash will change, if the x bits are changed in its the original input?

I came across a question stating: We have a message consisting of 10,000 characters. After computing its message digest using SHA-1, we decide to change the last 19 characters in the original message....
Vasu Deo.S's user avatar
7 votes
1 answer
8k views

Using a hash function as a random number generator

Using MD5 or SHA1 for instance, and applying integers (as seed so to speak) to the hash function, in sequence, and only keeping, say, the first 64 bits of the resulting hash, do we always have a ...
Déjà vu's user avatar
  • 175
7 votes
1 answer
32k views

What does AES256-CTS-HMAC-SHA1-96 mean in relation to Kerberos?

I'm not completely clueless as to what it means, but I'd like to understand it at a higher level. The highest encryption type used by Active Directory domain controllers for Kerberos authentication ...
Ryan Ries's user avatar
  • 173
7 votes
3 answers
2k views

Statistical properties of hash functions when calculating modulo

When using SHA-1 to hash an input, the result is a pseudo-random number in the numeric ID space $\{0\dots2^{160}-1\}$. Do I loose any statistical property in the result if I use modulo to restrict the ...
Chris's user avatar
  • 173
7 votes
1 answer
700 views

Is SHA-1 safe for signing ECDHE parameters?

Is using the SHA-1 algorithm insecure for hashing the ephemeral ECDH public key in the signed_params structure? There are some worrying articles about using SHA-1: ...
wilson's user avatar
  • 71
7 votes
1 answer
6k views

TLS: Is Integrity assured when using NULL cipher

In specific implementation we're using TLS 1.0, open ssl 0.9.8 but i'm referring to RFC 5246. For performance reasons, I'm being asked if we can use TLS without encryption. The hope is that the ...
dancl's user avatar
  • 205
6 votes
2 answers
8k views

What does "bits" mean in the context of hash functions?

What does the "bits" in hash functions mean? I started studying hash functions but I still do not understand what the bits mean. What does it mean to say that MD5 is 128-bits or that SHA-1 is 160 ...
Amaurijr's user avatar
6 votes
1 answer
693 views

How is it possible to detect "unknown SHA-1 cryptanalytic collision attacks given just a single file from a colliding file pair"?

The following description from http://shattered.it caught my eye: How do I detect this attack? You can use the online tool above to submit files and have them checked for a cryptanalytic ...
cmeeren's user avatar
  • 163
6 votes
1 answer
7k views

HMAC-SHA1 input size

I know that the HMAC is a message authentication code that uses a cryptographic key in conjunction with a hash function (SHA1 , MD5, etc.). The HMAC output is 160 bits for HMAC-SHA160 and 256 bits for ...
zof's user avatar
  • 399
5 votes
2 answers
406 views

"One-Wayness" of SHA 1

I recently started learning about Hash Functions for my first time, and I've gone through and have tried to understand the SHA1 process. Brilliant does an excellent job of explaining it step by step. ...
joshuaronis's user avatar
4 votes
1 answer
557 views

Does hash_df use binary or an ASCII hexadecimal representation for numbers to be passed to the hash function?

I'm implementing the HASH_DRBG algorithm. As per NIST-SP800 90 document for HASH DRBG Generation, section 10.4.1 "Derivation Function Using a Hash Function (Hash_df)", the Hash_df algorithm contains ...
Lunar Mushrooms's user avatar
4 votes
1 answer
502 views

Combining secure hashes with insecure hashes?

Assuming I'm a bank which seeks for secure hash functions to use in the process of signing on digital contents. I'd like to explain / prove why using each one of the following hash functions might ...
Jjang's user avatar
  • 365
4 votes
1 answer
2k views

Can I use SHA1 as license key?

I have recently started looking into creating secure, while not validating against an external server, software product keys. The idea I have had is to create a key consisting of two parts firstly a ...
MindStormer's user avatar
4 votes
2 answers
358 views

Are there valid attacks on full SHA-1?

Google today announced they are sunsetting SHA-1. Its fine by me. But that made me realize I am not keeping up with the research on SHA-1. The Wikipedia page only says Stevens' attack is the most ...
user220201's user avatar