Questions tagged [sha-1]

SHA-1 is a hash function that is two generations old, no longer considered secure for all uses and should only be used for backward compatibility.

Filter by
Sorted by
Tagged with
5
votes
1answer
645 views

How is it possible to detect “unknown SHA-1 cryptanalytic collision attacks given just a single file from a colliding file pair”?

The following description from http://shattered.it caught my eye: How do I detect this attack? You can use the online tool above to submit files and have them checked for a cryptanalytic ...
5
votes
1answer
1k views

SHA-1 – Would using a SHA1 signature be a risk?

If data (e.g. an e-mail, pdf file, xml content) is hashed using SHA-1 and then signed by a SHA-2 certificate, is this any bigger of a risk than using a SHA-2 hash with a SHA-2 certificate? I assume ...
8
votes
2answers
2k views

SHA-1 – Why is it hard to find a certificate collision?

Why is it it’s so much harder to execute a successful collision on certificates than it is on text data? I assume this has to do with the fact the certificate actually is a file that contains signed (...
1
vote
1answer
123 views

SHA-1 – Why are text containers used for certificates?

Why are researchers using text files to prove the successful collisions? In the case of the first MD5 collisions I believe it was PostScript-files. In the case of the recent SHA-1 collision it’s PDF ...
3
votes
1answer
680 views

Can a self-signed certificate's signature algorithm be changed?

I've a large number of self-signed certificates that are currently being used by multiple clients which were signed with the SHA1 ('SHA1WITHRSA' as it appears in the cert) algorithm at the time they ...
4
votes
1answer
1k views

Is there a checksum that gives the same checksum when in a text file?

Let's say I have a text file (crypto.txt). Let's assume the checksum function can be any type of function (MD5, SHA-1, anything else). Is there a way that the checksum value IN the file (crypto.txt ...
2
votes
1answer
802 views

Why not combine hashing algorithms? [duplicate]

The recent SHA1 collision got me thinking.. why do we always throw out the baby with the bathwater when moving to more modern hashing algorithms? When GIT was written, they went with SHA1 hashes ...
5
votes
1answer
372 views

How is the SHA-1 collision detector so fast?

The google collision website shattered.it refers to a collision detector: https://github.com/cr-marcstevens/sha1collisiondetection. It claims a false positive rate of $2^{-90}$ and to take less then ...
24
votes
1answer
2k views

What is hardened SHA-1, how does it work and how much protection does it offer?

From the shattered website: You can use the online tool above to submit files and have them checked for a cryptanalytic collision attack on SHA-1. The code behind this was developed by Marc Stevens ...
98
votes
2answers
18k views

What is the new attack on SHA-1 “SHAttered” and how does it work?

There's a new recent Attack on SHA-1 named "SHAttered" by Google and some researchers. I understand that it uses some fancy new techniques, but not the details. My question is: How? How does the ...
0
votes
1answer
420 views

Wikipedia pseudo code is unclear about how to pad SHA-512

In Wikipedia pseudo code of SHA-512 the padding section says pad 1 bit then 0 bits. It then goes on to say append length without 1 or 0 padding. What does that mean? https://en.wikipedia.org/wiki/SHA-...
4
votes
3answers
2k views

SHA-1 hash where each of the first 16 bytes is even

Is it possible for a SHA-1 hash to have the first 16 characters with a character code $c$ where $c \bmod 2 = 0$? So given the hash, hash[i] % 2 must be 0 for all ...
3
votes
3answers
429 views

Does the Shappening mean HTTPS can be broken?

For years we've been warned that SHA-1 is weaker than originally thought and should not be used. This reached its peak with the Shappening and experts from Schneier on down have been warning that we ...
4
votes
1answer
161 views

Is it possible to work out the hash using length extension attack but with different hashes type?

For example, I have: Unknown: A secret variable, lets call it secret, that is unknown to me Known: The length of secret, (lets ...
12
votes
1answer
310 views

Why doesn't Wang's attack work on SHA-1?

Wang's (et al) differential attack works on MD5, MD4, RIPEMD and HAVAL. Why doesn't it work on SHA-1?
0
votes
1answer
136 views

Have any SHA-1 collisions happened? [duplicate]

No SHA-1 collisions are actually known, though there are a number of cryptographic attacks to weaken it. But, how likely is it that, of all the SHA-1 hashes computed since the invention of the ...
1
vote
2answers
432 views

using hash function of (key||plaintext) instead of random value for IV

for a protocol which implements AES under CBC mode, an $IV $(initialization vector) is required for each encryption. Instead of picking the $IV$ randomly, is it advisable for us to set the $IV$ to be $...
29
votes
1answer
2k views

How are the functions used in cryptographic hash functions chosen?

I'm learning about cryptographic hash functions and I have some questions about the functions used in the compression function. MD5 uses the following functions: $f_{1}(B,C,D)=(B\wedge C)\lor(D\...
2
votes
2answers
937 views

Truncated 60 bit SHA1 collision detection?

So, I have managed to get a 52 bit collision for a SHA1 but after three days of brute forcing, I am unable to get a 60 bit collision. My question is simple, how should I approach this? I am ...
0
votes
1answer
2k views

Collision in SHA-1 first 8 bytes [closed]

I'm trying a Birthday Attack to randomly generated strings and its $\mathop{SHA-1}$ hashes using a Mapped table of values in order to find a collision on only the first 8 bytes. With the first 4 or 5 ...
5
votes
2answers
2k views

Is the SHA1 hash of MD5 hash of a password secure?

Cryptography is not my area, so pardon me if the question is annoying. Some time ago, I implemented an Internet site, which database had a users table. To keep the password in its user table field, I ...
2
votes
1answer
525 views

Building blocks of SHA-1 and SHA-2

I ask myself some questions about the compression function of SHA-2 (and SHA-1) hash function. Are these compression functions based on a block cipher? I've not found this information on Wiki... So, I ...
1
vote
2answers
2k views

HMAC and SHA-1 weakness?

Imagine the following scenario: Select known data (known to several parties) Mix data with secret key and generate SHA-1 hash Mix SHA-1 hash with secret key and generate HMAC The purpose is to ...
2
votes
1answer
162 views

Does this proof sketch show that finding a SHA-1 preimage is NP-hard?

Jutla & Patthak wrote "Is SHA-1 conceptually sound?" back in 2005, in which they provide a proof sketch (Appendix A) to show that finding a preimage for SHA-1 is NP-hard. Now, there are some ...
2
votes
1answer
660 views

SHA-1 requires utf-8 and reordering of bytes

Today I implemented SHA-1 in JavaScript. While doing so I stumbled upon two requirements which are not mentioned in the RFC-3174. Text is supposed to be utf-8 encoded / one character should be 8 bit ...
9
votes
1answer
599 views

Why does SHA-1 rotate the variables A and B?

SHA-1 has an operation within round j in stage t, where the functions $f_t$ and $K_t$ change depending on the stage. Is there a specific reason why the variable $A$ is rotated by 5? How does this ...
4
votes
1answer
161 views

Why does this SHA-1 relation hold?

In De Canniere & Rechberger's 2008 paper "Preimages for Reduced SHA-0 and SHA-1", the following statement appears on page 6: Suppose that we restrict ourselves to the first $j$ + 1 bits of each ...
9
votes
3answers
5k views

Advantages/disadvantages of using symmetric encryption function as hash function?

Next to the traditional MD5 and SHA-1, other hashing algorithms exist based on symmetric encryption algorithms. An example is the Matyas–Meyer–Oseas construction. What are the advantages/...
4
votes
1answer
3k views

How hard is it to generate a simultaneous MD5 and SHA1 collision?

I was recently reading that MD5 is "broken" because it's pretty easy to generate collisions (like 2^(L/2)). And the SHA1 (theoretically) fares no better. The ...
4
votes
1answer
1k views

Where in the FIPS documents is it stated that SHA-1 is not secure?

SHA-1 has not been secure for a very long time, but I still can see it here. Where in the FIPS documents did it state that SHA-1 is not secure?
4
votes
1answer
341 views

Combining secure hashes with insecure hashes?

Assuming I'm a bank which seeks for secure hash functions to use in the process of signing on digital contents. I'd like to explain / prove why using each one of the following hash functions might ...
3
votes
1answer
154 views

Can the attack against SHA-1 be parallelized?

Can this attack be parallelized? It is a $2^{57}$ complexity collision attack on SHA-1 based on disturbance vectors. If it is practical it is easy on a GPU ($\approx1.1$ GPU-days). If it is ...
9
votes
2answers
9k views

How long should a HMAC cryptographic key be?

In the top answer to this question the answerer says 'with a sufficently long key'. I am using a SHA1-HMAC (may switch to SHA256-HMAC) algorithm to verify cookies sent to clients as authentication ...
3
votes
1answer
463 views

What is the probability of attacking SHA1 used in RSA signature with small exponent?

There is RSA signature check which has following properties: RSA modulus N which is 2048-bit RSA public exponent equal 41 (0x29) Genuine Signature uses EMSA-PKCS1-v1_5 padding of SHA1 hash, however ...
0
votes
2answers
1k views

Encrypting using “Cryptography.HMACSHA1”, how to decrypt (VBA)

I have an encryption routine that works very well in VBA. But now I need to program the decryption routine, and I'm stuck. For encryption I'm using HMACSHA1 and transferring the encrypted byte to base ...
1
vote
1answer
326 views

Can I get successful signature verification with just altering message and signature?

Assuming I can modify a message and also modify the verification signature, and I also have the public-key but not the private-key. Can I create a message that can be verified with a signature that I ...
3
votes
1answer
1k views

Deriving AES key and HMAC key from shorter master key

I am working in .NET and as far as I can tell the only choice for key derivation is PBKDF2-HMAC-SHA1. SHA1's output size is only 160 bits. But I am implementing authenticated encryption and thus ...
2
votes
1answer
747 views

Deriving 256-bit key from PBKDF2-SHA1

I am working in .NET and their PBKDF2 only uses SHA-1. I am using it to, given a user-supplied password and random salt, generate a 256-bit AES key. The plaintext is encrypted with the AES key and ...
2
votes
2answers
673 views

Is Schannel supposed to use SHA1 for (EC)DHE params?

I captured a TLS 1.2 handshake on my server (WIN2012.R2/IIS 8.5) and noticed that SHA1 is being used to hash ECDHE parameters despite both the server and client(s) supporting SHA2 signatures. ...
0
votes
2answers
3k views

SHA1 collision for first 32 bits for two different messages

Is it possible to create a program to find the collision of 2 different messages with the same first 32 bits using sha1 hashing? I tried using a while loop, but it ran endlessly as though no match ...
1
vote
1answer
989 views

SHA-1: number of possible inputs, number of possible outputs, how many inputs have the same output,

From Wikipedia I read SHA-1 function produces an output of 160 bits and expects a max message size of $2^{64}-1$ bits. Is that right? If I order all possible inputs I would produce $\approx 2^{2^{64}}...
1
vote
1answer
159 views

Are chosen-prefix collisions for SHA-1 a major threat?

GPG signing of Git commit tags relies on the collision resistance of SHA-1, which is weak. However, the attacker does not get to choose the prefix. How much does this translate to an actual ...
1
vote
1answer
230 views

Given the first half of a SHA-1 hash, can you predict the second half?

I know this applies to secure ciphers, but does this also apply to hashes?
1
vote
1answer
600 views

Better security than SHA1 for signature?

An application that I maintain uses Sparkle Update to update itself. I expect attacks from high level attackers (China, USA's NSA, etc.) and have some questions about how secure the cryptography ...
1
vote
0answers
57 views

Impact of Git's use of SHA-1? [closed]

Git uses SHA-1, and it is common to sign Git commit or tag hashes to authenticate a repo. Is this insecure now?
6
votes
2answers
1k views

What is the threat to a PKI when the root CA certificate is generated using SHA1?

We have thousands of servers that have been issued certificates signed by our CA using SHA256 but the our root CAs own certificate was generated using SHA1. Assuming SHA1 is no longer secure for our ...
0
votes
1answer
170 views

Difference between HMAC-SHA1(key, msg) vs SHA1(key + msg) [duplicate]

Is there any practical difference from using HMAC-SHA1(key, msg) vs SHA1(key + msg) as a way to verify the authenticity/...
2
votes
2answers
2k views

Finding collisions in SHA1

I am trying to find two collisions in SHA1 for the 50 least significant bits. I was wondering if there was a way to efficiently do this without having to brute force all of the possible hash outputs? ...
12
votes
3answers
10k views

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

SHA-1 and SHA-2 share the same structure and mathematical operation as their predecessors - SHA-0 and MD5. Both SHA-0 and MD5 have been broken. This is one of the main reasons why SHA-1 is considered ...
2
votes
1answer
1k views

Merkle tree (dm-verity) with SHA-256 vs. SHA-1

Is there any knowledge or research on the use of different hash functions within a Merkle tree? My use case is file integrity protection. I am thinking about using different hash functions due to ...