Skip to main content

Questions tagged [sha-1]

SHA-1 is a hash function that is two generations old, no longer considered secure for all uses and should only be used for backward compatibility.

Filter by
Sorted by
Tagged with
2 votes
1 answer
4k views

What is the use of encoding a hash output?

In many applications, the MD5 algorithm is used which produces a 128-bit output which is represented as a sequence of 32 hexadecimal digits. This output is further encoded using a base62 or base64 ...
Jainabhi's user avatar
18 votes
1 answer
12k views

In 2020, SHA-1 practically broken in chosen-prefix collision (CP-collision). Can double SHA-1 hashing prevent CP-collision?

In a recent study SHA-1 is a Shambles - First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust by Gaëtan Leurent and Thomas Peyrin. 2020, they showed the first practical chosen-...
kelalaka's user avatar
  • 49k
5 votes
2 answers
406 views

"One-Wayness" of SHA 1

I recently started learning about Hash Functions for my first time, and I've gone through and have tried to understand the SHA1 process. Brilliant does an excellent job of explaining it step by step. ...
joshuaronis's user avatar
6 votes
1 answer
535 views

Do a 160-bit SHA-1 hash and a 160-bit slice of a SHA-256 hash have the same strength in terms of collision-free?

Take OpenPGP fingerprint for example. If the 40-digit hex standard remains unchanged, would it be helpful to upgrade SHA-1 to SHA-256 (but only taking the last 160 bits), in terms of reducing the risk ...
user3332315's user avatar
0 votes
1 answer
134 views

Equal hashes for different messages when doing key length extension attack sha1

I was doing the cryptopals challenge 29, and I found something weird. When I try to create a forged hash for a forged message I get always the same hash for different forged messages. ...
meowmeowxw's user avatar
3 votes
3 answers
3k views

Is using RSA with SHA-1 considered as secure as HMAC-SHA-1?

I know SHA-1 hashing is regarded insecure. HMAC-SHA-1 is still regarded secure as this is an encryption process with symmetric key of the hash produced by SHA-1. So signing using RSA with a key size ...
philippe's user avatar
  • 193
0 votes
1 answer
458 views

How to use SHA-1 as a PRNG?

Is there any special parameters for using SHA-1 for generating pseudo-random numbers? What are the differences between SHA-1 as a PRNG and original SHA-1?
reogeo's user avatar
  • 15
1 vote
3 answers
6k views

CRC32 catches errors, but then what's the point of SHA?

If crc or CRC32 is specially designed to catch errors, then what's the point of SHA or md4-5 or any other hashing function? What I did was, I had a 190 mb png file (rendered in 16k resolution with ...
Ömer Enes Özmen's user avatar
5 votes
2 answers
2k views

Is it feasible to get a hash collision for CRC32, MD-5 and SHA-1 on one file?

I'm aware that individually, each has its weaknesses (especially CRC32), but is it feasible that a file could be created to falsely match all three?
Hiccup's user avatar
  • 161
4 votes
1 answer
81 views

Recover secret SHA-1 constants given Oracle

There's a black box that's basically SHA-1, except that the constants (h0, h1,...,h4) are secret. We can pass it arbitrary inputs and get the corresponding outputs. Given this, is it possible to ...
redfast00's user avatar
  • 197
0 votes
0 answers
116 views

Which SHA-1 attacks apply to TOTP tokens? [duplicate]

Update: it's actually hmac(secret, time). I'll leave the post as-is, in case someone is ever looking for the hash(secret+time) ...
Luc's user avatar
  • 1,528
7 votes
2 answers
5k views

Does a hash function have a Upper bound on input length?

I came across this Answer stating (just a line from the answer):- The input space is "infinite" and thus it has an infinite amount of values that will collide into a single hash And in the ...
Vasu Deo.S's user avatar
10 votes
3 answers
6k views

How many bits in the resultant hash will change, if the x bits are changed in its the original input?

I came across a question stating: We have a message consisting of 10,000 characters. After computing its message digest using SHA-1, we decide to change the last 19 characters in the original message....
Vasu Deo.S's user avatar
1 vote
2 answers
463 views

Why authors of bcrypt have chosen blowfish and not some hash function like SHA-1?

I wonder what are the advantages of using bcrypt over an iterated and salted KDF based on some cryptographic hash function like SHA-1 (or SHA-3)? I guess the authors of bcrypt chose Blowfish (a block ...
matlink's user avatar
  • 39
3 votes
1 answer
777 views

Where do the constants for SHA-1/2/3 come from?

My request is: I need to know the source of constants (shift constants, IV, or S-Box) for the following algorithms: SHA-1 SHA-2 (all sizes) SHA-3 Examples: BLOWFISH uses the hexadecimal ...
m.nasim's user avatar
  • 105
2 votes
1 answer
978 views

SHA1 padding on length extension attack

I was recently trying to replicate a length extension attack on SHA1. I implemented the registers state and also the new padding implementation (with the whole of the message that I want to extend). ...
Diego Bernal's user avatar
2 votes
1 answer
96 views

About the security of GnuPG private key on-disk storage

GnuPG on-disk storage of secret key material is encrypted with AES-128, with an encryption key generated via an iterated and salted SHA-1 hash of the given passphrase. Is this usage of the SHA-1 hash ...
user3368561's user avatar
7 votes
1 answer
514 views

Which TLS features are vulnerable to chosen-prefixes collision on SHA-1?

Gaëtan Leurent and Thomas Peyrin's preprint From Collisions to Chosen-Prefix Collisions - Application to Full SHA-1 (in volume 1 of proceedings of the forthcoming Eurocrypt 2019) shows a feasible ...
fgrieu's user avatar
  • 142k
0 votes
2 answers
570 views

SHA1 calculation for millions of strings having common prefix

I have a function in which I need to calculate SHA1(common_prefix + random_string). I am calling this function many times so that calculation of SHA1 slows down the performance of the function. As for ...
user1945535's user avatar
0 votes
1 answer
162 views

What is a SHA1_Compress() function?

I'm trying to implement the scrypt key derivation function using JavaScript. When implementing the algorithm, I found that there was a function called SHA1_Compress listed in the specification. Is the ...
JasonHK's user avatar
4 votes
1 answer
823 views

Partial known message pre-image attack on SHA-1

If the last $448$ bits of a SHA-1 block input are known and only the first $64$ bits are unknown, is it possible to do a preimage attack using SAT solvers or something else? Or do I have to brute ...
Amin Habibi's user avatar
0 votes
1 answer
4k views

How to change hash checksum of a text file without changing the contents in the file

I have created a text file called test.txt and the content of the file is Hello World I would like to change the SHA checksum hash without modifying the contents and filename. Is there any way to do ...
CryptoFalcon's user avatar
7 votes
1 answer
8k views

Using a hash function as a random number generator

Using MD5 or SHA1 for instance, and applying integers (as seed so to speak) to the hash function, in sequence, and only keeping, say, the first 64 bits of the resulting hash, do we always have a ...
Déjà vu's user avatar
  • 175
2 votes
2 answers
752 views

SHA-1 collision for strings of two symbols

Is it possible to have strings of two (Unicode) symbols with equal SHA-1 hash? For example, smth like "ab", "ba".
Woland's user avatar
  • 123
9 votes
1 answer
5k views

What is the use of SCRAM-SHA-256 (over SCRAM-SHA-1)?

The Salted Challenge Response Authentication Mechanism (SCRAM) specified in RFC 5802 can use arbitrary hash functions to operate. The base version from RFC 5802 uses SHA-1. From my understanding, ...
Jonas Schäfer's user avatar
-3 votes
1 answer
181 views

Which is more secure? $\operatorname{AES-ECB}(key,\operatorname{SHA1}(data+key))$ vs $\operatorname{HMAC-SHA1}(key, data)$ [closed]

$\operatorname{AES-ECB}(key,\operatorname{SHA1}(data+key))$ vs $\operatorname{HMAC-SHA1}(key, data)$ Which is more secure? Which is faster? There is a similar comparison here; HMAC-SHA1(key, data) ...
Nayan Karan's user avatar
-3 votes
1 answer
178 views

cipherText = aes-ctr(key, iv+1, (plainText)); & authTag= aes-ctr(key, iv, aes-ecb(key, sha-1(cipherText+authData+key+iv))); is it secure? [closed]

Proposed Cipher suite (using aes-ecb): ...
NKaran's user avatar
  • 5
-3 votes
1 answer
180 views

aes-ctr(key, ++iv, sha-1(plainText + aes-ctr(key,iv,0^128))+(plainText + aes-ctr(key,iv,0^128))); is it secure? [closed]

Proposed Cipher suite: aes-ctr(key, ++iv, sha-1(plainText + aes-ctr(key,iv,0^128))+(plainText + aes-ctr(key,iv,0^128))); Security targets achieved: Encryption of the plain text. Integrity of the ...
distinguishedUser's user avatar
1 vote
1 answer
158 views

Unable to reproduce correct signature data

"Skatteetaten" is the Norwegian tax authority. We're currently trying to implement signing of messages for digital cash registry systems and i'm not able to reproduce the desired signed data. Went ...
JazzCat's user avatar
  • 119
1 vote
0 answers
23 views

GlobalSign cert in Trusted root for Google Services shows Sha1. Security postures

"GlobalSign" certificate in Trusted Root Certification Authorities for Google Services shows Sha1. Security postures are different than just 2-3 yr ago. At my home, router bought 2016, networked; ...
Tom Hege's user avatar
2 votes
3 answers
527 views

Changing SHA-1 constants an functions: Does it affect security?

I have been looking into the SHA-1 algorithm. I found that there are a set of functions and constants in the algorithm that have been standardized (section 5 of RFC 3174). If I want to use SHA-1, ...
Abdulahi's user avatar
15 votes
2 answers
7k views

How reassuring is 64-bit (in)security?

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity....
DannyNiu's user avatar
  • 9,422
9 votes
1 answer
5k views

Is SHA-1 secure when used to implement a PRNG

I read SHA-1 is still a secured hashing function with no collision found as of now. However, it's just a matter of time for someone to come up with such a collision or attack. Therefore, in new ...
Saptarshi Basu's user avatar
1 vote
0 answers
88 views

Nature of risk(s) from KeeChallenge XML file stored in cloud at Onedrive

As a noob user of KeePass2 on Windows desktop and Keypass2Android on my phone, supplemented by YubiKey Neo configured for hmac-sha1 challenge response, I noticed that Keepass2Android appears to store ...
greybeered's user avatar
2 votes
0 answers
750 views

Is it possible to prevent length extension attacks

Is it possible to prevent length extension attacks without using any other hash algorithm than SHA-1?
Ashley Watson's user avatar
1 vote
0 answers
669 views

Is it still safe to use sha1 as an hmac hash function in 2018 [duplicate]

I'm curious if it's safe to use sha1 for an HMAC in 2018 in a platform product. A popular vendor (Twilio) uses an HMAC with sha1 with a shared secret to validate that messages they send are indeed ...
greggles's user avatar
  • 111
37 votes
3 answers
8k views

Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?

Note: I am not advocating anyone continues using SHA1-signed certificates: they are dead as far as security is concerned and should no longer be used. I'm just trying to clarify my understanding of ...
TripeHound's user avatar
17 votes
3 answers
13k views

After Google's collision attack, is RSA-SHA1 signature still safe?

Google succeeded to get a collision in SHA-1 last year in an attack called shattered. Does this fact make certificates based RSA-SHA1 Signature risky for creating fraud certificates? If RSA-SHA1 ...
adi's user avatar
  • 175
0 votes
2 answers
2k views

Fastest way to compute iterates of SHA1

It's well-known that computing lots of hash functions (like SHA1) in parallel involves the use of GPUs in most cases. However, when doing something serially, such as computing ...
Fixee's user avatar
  • 4,168
0 votes
2 answers
1k views

TLS1.2 AES 128 CBC Encrypted Data size is not a multiple of block size [closed]

I know that TLS ciphers such as TLS_RSA_WITH_AES_128_CBC_SHA transmit data as shown https://www.rfc-editor.org/rfc/rfc5246#section-6.2.3.2. From my understanding the ciphertext MUST be a multiple of ...
user3452345224's user avatar
4 votes
4 answers
18k views

Can SHA or MD5 results be decrypted?

I have learned that SHA-1 and MD5 are one way hash functions, which means that it is not possible to obtain the original value by performing the reverse calculation. There however some online ...
Arun Rajasekar's user avatar
2 votes
1 answer
197 views

local collisions in SHA 0

I have found interesting for me paper about constructing collisions in SHA 0. On page 60 the author determines M variable which is a concatenation of 32-bits vectors $M^{(i)}$, but I can't find any ...
Setplus's user avatar
  • 153
3 votes
1 answer
140 views

Statistical attacks on a list of MD5/SHA-1 hashes?

I have a list of MD5 and SHA-1 hashes where the input string is of the form secret1000 secret1001 … all the way up to ...
joseconte2018's user avatar
3 votes
1 answer
281 views

Birthday problem applied to hash function with partition of the input set

I am not able to understand why if we consider a regular hash function, it is possible to say that we are partitioning the starting set and then apply the the birthday paradox/problem. Can anyone ...
hesse's user avatar
  • 39
1 vote
1 answer
164 views

Backward Expansion of SHA1

Given a SHA1 hash, is it now possible to "practically" find the source material that was passed through SHA1 now that the Shattered paper has produced the first "practical" collision? As a follow on ...
Derek's user avatar
  • 155
2 votes
1 answer
56 views

Expanding truly random key into printable password for successive hashing

The STUN network protocol defines its client authorization in the terms of message-integrity check employing the following scheme [RFC5389, section 10.2]: $$ \DeclareMathOperator{\HMAC}{HMAC} \...
firegurafiku's user avatar
1 vote
2 answers
602 views

Purpose of folding a digest in half

The Linux kernel's random driver generates randomness by hashing an entropy pool using SHA-1. From the driver's source, the SHA-1 hash is apparently folded in half before being returned: ...
forest's user avatar
  • 15.3k
1 vote
2 answers
399 views

Optimal way to bind two hashes

Currently I have: H1 = SHA256 H2 = SHA1 Both H1 and H2 have fixed length. What's the most efficient way to bind H1 and H2 together into H3? The goal is to ...
Chester Turcotte's user avatar
1 vote
1 answer
311 views

Difficulty of generating a string "The (md5|sha1) hash of this string is (x)" that hashes to (x) vs. regular hash collision between files?

I know that collisions in md5 and sha1 have been demonstrated in particular pairs of files (by incrementing some none viewable portion of a PDF, etc). Would generating the above string be ...
Luke Mlsna's user avatar
2 votes
1 answer
307 views

Why does FIPS 180-4 require the final padding block start with a 1?

From FIPS 180-4 § 5.1.1, the padding used for the SHA family of hashes begins with a binary 1, followed by a number of 0s, and finally a 64-bit representation of the message length: Suppose that the ...
forest's user avatar
  • 15.3k