Hot answers tagged

117 votes
Accepted

How easy is it in 2022 to find a SHA1 collision?

According to some Hashcat benchmarks, a current Nvidia GPU can compute SHA-1 hashes at a rate of: NVIDIA GeForce RTX 3090 ~22.6×109 hashes per second NVIDIA GeForce RTX 3080 Ti ~21.7×109 hashes ...
  • 7,379
84 votes
Accepted

What is the new attack on SHA-1 "SHAttered" and how does it work?

In order to get a collision on a $n$ bit Random Oracle using the birthday paradox, one needs $\sqrt{\pi / 2} \cdot 2^{n/2}$ calls. In other words, in the case of the 160 output bits of SHA-1 the limit ...
  • 9,869
55 votes
Accepted

How secure is SHA1? What are the chances of a real exploit?

Actually SHA-1 has been "officially insecure" for a longer time, since an attack method was published in 2011. The 2017 collisions was just the first known case of actually running the attack. But ...
52 votes
Accepted

Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?

Yes, SHA1-signed certificates are unsafe. The SHAttered paper is instructive. From the introduction: The MD-SHA family of hash functions is the most well-known hash function family, which ...
36 votes
Accepted

Why is HMAC-SHA1 still considered secure?

In the first section of this answer I'll assume that through better hardware or/and algorithmic improvements, it has become routinely feasible to exhibit a collision for SHA-1 by a method similar to ...
  • 128k
35 votes
Accepted

How are the functions used in cryptographic hash functions chosen?

The functions considered are binary functions of 3 bits to 1 bit (extended to bit vectors, that is bitwise functions). There are $2^{(2^3)}=256$ such functions. All the functions considered are ...
  • 128k
34 votes
Accepted

After Google's collision attack, is RSA-SHA1 signature still safe?

The answer is "not safe". But it is not safe, regardless of Google's attack. Before Google attacked, we knew that SHA-1 is not the best choice. Google found one collision based on some existing, ...
32 votes

Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?

The existence of the SHAttered result is not, I think, in itself a surprise: everyone knows that in theory you can create two streams of bytes that hash to the same value. Google's achievements (which ...
  • 87.1k
30 votes
Accepted

In 2020, SHA-1 practically broken in chosen-prefix collision (CP-collision). Can double SHA-1 hashing prevent CP-collision?

a. No such double hashing doesn't do a bit of good. Anything which collides after a single hash will definetly collide after a double hash. It preserves all collisions and adds new ones. We might ...
  • 11.1k
29 votes
Accepted

How reassuring is 64-bit (in)security?

TL;DR; Just give me the numbers; Machines in a second in an hour in a day in a year Summit on SHA-1 $\approx 2^{49.7} $ $ \approx 2^{61.5}$ $\approx 2^{66.1}$ $\approx 2^{74.6}$ Titan on SHA-1 $\...
  • 45.2k
27 votes
Accepted

Why can't they just fix SHA-1 if it's broken?

I have 3 answers: We can't fix SHA-1, we shouldn't fix SHA-1 and we already did fix SHA-1. SHA-1 is a hash standard; many different people can and have implemented it and they all get the same results....
  • 11.1k
25 votes
Accepted

How many bits in the resultant hash will change, if the x bits are changed in its the original input?

For any one of the SHA hashes, the hash should be indistinguishable from pseudo-random. That means each and every bit flips with a chance of 50%. So on average half of the amount of bits gets flipped, ...
  • 87.1k
25 votes
Accepted

How to get an output of SHA-1 with first 2-bit are zeros?

Hash random values until you get a hash with two leading zeroes. We would expect about 1 in 4 values to have a hash-value of that form. So let's try this: ...
  • 6,452
24 votes

HMAC-SHA1 vs HMAC-SHA256

I would use HMAC-SHA256. While poncho's answer that both are secure is reasonable, there are several reasons I would prefer to use SHA-256 as the hash: Attacks only get better. SHA-1 collision ...
  • 31.5k
24 votes

What is the new attack on SHA-1 "SHAttered" and how does it work?

It is an approximately1 $2^{64}$ time identical-prefix collision attack on SHA-1 based on the same principles as Marc Stevens' earlier attacks on SHA-1. It is the first practical collision attack on ...
  • 31.5k
23 votes

Why can't they just fix SHA-1 if it's broken?

We can fix SHA-1 but why? SHA-1 is broken. We cannot fix it without modifying result (so compability won't be preserved). We can make changes that will fix it... for now, and also will make it ...
  • 2,920
22 votes
Accepted

What is hardened SHA-1, how does it work and how much protection does it offer?

Hardened SHA-1 detects collisions built of a certain form, If someone were to find a collision using brute-force birthday attack (currently not feasible) the detection would not work. The vectors are ...
  • 11.1k
20 votes

How reassuring is 64-bit (in)security?

There is a huge difference between $2^{-64}$ probability of failure, which is indeed very small, and having to run $2^{64}$ in order to carry out the attack. The latter is much too small to be ...
20 votes
Accepted

Does a hash function have a Upper bound on input length?

Does hashing algorithms have an upper bound in the input space? They can, but they don't have to and it depends on their specification. All Merkle-Damgård based hash functions do have an upper limit,...
  • 45k
19 votes

Why is HMAC-SHA1 still considered secure?

When people say HMAC-MD5 or HMAC-SHA1 are still secure, they mean that they're still secure as PRF and MAC. The key assumption here is that the key is unknown to the attacker. $$\mathrm{HMAC} = \...
  • 24.4k
18 votes
Accepted

How hard is it to generate a simultaneous MD5 and SHA1 collision?

Surprisingly enough, it would appear that generating a simultaneous collision wouldn't be that much more expensive than generating a single collision for SHA-1. The basic idea is to form a $2^{64}$ ...
  • 136k
16 votes

SHA-1 – Why is it hard to find a certificate collision?

Why is it it’s so much harder to execute a successful collision on certificates than it is on text data? It's not. Actually, the attacker does have to worry about the sequence number that the CA ...
  • 136k
14 votes

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

They are all hash functions. Apart from that, they are structurally quite different. The SHA family (SHA-0, SHA-1, and the SHA-2 functions such as SHA-256 and SHA-512) use the Merkle-Damgård ...
13 votes
Accepted

SHA-1 collisions - what about practical attacks?

The question asks how a collision in a hash such as SHA-1 could become a practical concern, with focus on the case of a public-key certificate à la X.509. I'll first give an example involving ...
  • 128k
13 votes
Accepted

Advantages/disadvantages of using symmetric encryption function as hash function?

The disadvantage of this approach is that block ciphers are not necessarily designed with this goal in mind. Specifically, AES has related-key problems, and DES completely breaks in Davies-Meyer. In ...
13 votes

How to get an output of SHA-1 with first 2-bit are zeros?

This is an extension of Maeher's answer and the full code of this answer is in Github. Hash functions are expected to produce random output random in the sense that the value of the hash is basically ...
  • 45.2k
12 votes

Purpose of expanding then shrinking in SHA-1

Expanding then shrinking in SHA-1 refers to the process, performed for each round (each 512-bit block of padded message), of message expansion from 512 bits to 2560 bits; keeping only 160 bits of ...
  • 128k
12 votes
Accepted

What was the NSA's reasoning for making their bitwise combination functions in SHA-1 the way they did?

What choice did they have? F1 is a bitwise function with three inputs and one output. There are $2^8 = 256$ such functions. Only 70 of them are "unbiased" (i.e. have as many 0 and 1 outputs in their ...
  • 31.5k
12 votes
Accepted

Is SHA-1 secure when used to implement a PRNG

I read SHA1 is still a secured hashing function with no collision found as of now. You read an old text, this is not the case anymore since SHA-1 was SHAttered. In Java, we still use SHA1PRNG ...
  • 87.1k
11 votes

Why is SHA-1 considered broken?

Yes, it is considered broken since SHA-1 collision has been found. On 23 February 2017, Google announced the first SHA-1 public collision using the SHAttered attack (100k faster than the brute force ...
  • 607

Only top scored, non community-wiki answers of a minimum length are eligible