119
votes
Accepted
How easy is it in 2022 to find a SHA1 collision?
According to some Hashcat benchmarks, a current Nvidia GPU can compute SHA-1 hashes at a rate of:
NVIDIA GeForce RTX 3090 ~22.6×109 hashes per second
NVIDIA GeForce RTX 3080 Ti ~21.7×109 hashes ...
- 7,629
85
votes
Accepted
What is the new attack on SHA-1 "SHAttered" and how does it work?
In order to get a collision on a $n$ bit Random Oracle using the birthday paradox, one needs $\sqrt{\pi / 2} \cdot 2^{n/2}$ calls. In other words, in the case of the 160 output bits of SHA-1 the limit ...
- 9,969
56
votes
Accepted
How secure is SHA1? What are the chances of a real exploit?
Actually SHA-1 has been "officially insecure" for a longer time, since an attack method was published in 2011. The 2017 collisions was just the first known case of actually running the attack. But ...
- 86.6k
52
votes
Accepted
Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?
Yes, SHA1-signed certificates are unsafe.
The SHAttered paper is instructive. From the introduction:
The MD-SHA family of hash functions is the most well-known hash function family, which ...
- 47.9k
36
votes
Accepted
How are the functions used in cryptographic hash functions chosen?
The functions considered are binary functions of 3 bits to 1 bit (extended to bit vectors, that is bitwise functions). There are $2^{(2^3)}=256$ such functions.
All the functions considered are ...
- 138k
34
votes
Accepted
After Google's collision attack, is RSA-SHA1 signature still safe?
The answer is "not safe".
But it is not safe, regardless of Google's attack. Before Google attacked, we knew that SHA-1 is not the best choice.
Google found one collision based on some existing, ...
- 564
32
votes
Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?
The existence of the SHAttered result is not, I think, in itself a surprise: everyone knows that in theory you can create two streams of bytes that hash to the same value. Google's achievements (which ...
- 91.8k
30
votes
Accepted
In 2020, SHA-1 practically broken in chosen-prefix collision (CP-collision). Can double SHA-1 hashing prevent CP-collision?
a. No such double hashing doesn't do a bit of good. Anything which collides after a single hash will definetly collide after a double hash. It preserves all collisions and adds new ones.
We might ...
- 11.7k
29
votes
Accepted
How reassuring is 64-bit (in)security?
TL;DR; Just give me the numbers;
Machines
in a second
in an hour
in a day
in a year
Summit on SHA-1
$\approx 2^{49.7} $
$ \approx 2^{61.5}$
$\approx 2^{66.1}$
$\approx 2^{74.6}$
Titan on SHA-1
$\...
- 47.6k
27
votes
Accepted
Why can't they just fix SHA-1 if it's broken?
I have 3 answers: We can't fix SHA-1, we shouldn't fix SHA-1 and we already did fix SHA-1.
SHA-1 is a hash standard; many different people can and have implemented it and they all get the same results....
- 11.7k
25
votes
Accepted
How many bits in the resultant hash will change, if the x bits are changed in its the original input?
For any one of the SHA hashes, the hash should be indistinguishable from pseudo-random. That means each and every bit flips with a chance of 50%. So on average half of the amount of bits gets flipped, ...
- 91.8k
25
votes
Accepted
How to get an output of SHA-1 with first 2-bit are zeros?
Hash random values until you get a hash with two leading zeroes. We would expect about 1 in 4 values to have a hash-value of that form.
So let's try this:
...
- 6,613
24
votes
What is the new attack on SHA-1 "SHAttered" and how does it work?
It is an approximately1 $2^{64}$ time identical-prefix collision attack on SHA-1 based on the same principles as Marc Stevens' earlier attacks on SHA-1. It is the first practical collision attack on ...
- 32k
23
votes
Accepted
What is hardened SHA-1, how does it work and how much protection does it offer?
Hardened SHA-1 detects collisions built of a certain form, If someone were to find a collision using brute-force birthday attack (currently not feasible) the detection would not work.
The vectors are ...
- 11.7k
23
votes
Why can't they just fix SHA-1 if it's broken?
We can fix SHA-1 but why?
SHA-1 is broken. We cannot fix it without modifying result (so compability won't be preserved). We can make changes that will fix it... for now, and also will make it ...
- 2,930
20
votes
Accepted
How hard is it to generate a simultaneous MD5 and SHA1 collision?
Surprisingly enough, it would appear that generating a simultaneous collision wouldn't be that much more expensive than generating a single collision for SHA-1.
The basic idea is to form a $2^{64}$ ...
- 145k
20
votes
How reassuring is 64-bit (in)security?
There is a huge difference between $2^{-64}$ probability of failure, which is indeed very small, and having to run $2^{64}$ in order to carry out the attack. The latter is much too small to be ...
- 27.6k
20
votes
Accepted
Does a hash function have a Upper bound on input length?
Does hashing algorithms have an upper bound in the input space?
They can, but they don't have to and it depends on their specification.
All Merkle-Damgård based hash functions do have an upper limit,...
- 45.7k
16
votes
SHA-1 – Why is it hard to find a certificate collision?
Why is it it’s so much harder to execute a successful collision on certificates than it is on text data?
It's not. Actually, the attacker does have to worry about the sequence number that the CA ...
- 145k
14
votes
What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?
They are all hash functions. Apart from that, they are structurally quite different. The SHA family (SHA-0, SHA-1, and the SHA-2 functions such as SHA-256 and SHA-512) use the Merkle-Damgård ...
- 86.6k
13
votes
Accepted
Advantages/disadvantages of using symmetric encryption function as hash function?
The disadvantage of this approach is that block ciphers are not necessarily designed with this goal in mind. Specifically, AES has related-key problems, and DES completely breaks in Davies-Meyer. In ...
- 27.6k
13
votes
How to get an output of SHA-1 with first 2-bit are zeros?
This is an extension of Maeher's answer and the full code of this answer is in Github.
Hash functions are expected to produce random output random in the sense that the value of the hash is basically ...
- 47.6k
12
votes
Accepted
Is SHA-1 secure when used to implement a PRNG
I read SHA1 is still a secured hashing function with no collision found as of now.
You read an old text, this is not the case anymore since SHA-1 was SHAttered.
In Java, we still use SHA1PRNG ...
- 91.8k
11
votes
Accepted
For any hash value, is there an infinite number of inputs that hash to it?
As rightly pointed by Henrick Hellström and Otus, FIPS 186-4 defines SHA-1 with a maximum message length of $2^{64}-1$ bits, hence it is certain that no 160-bit value is the hash of an infinite ...
- 138k
11
votes
Why is SHA-1 considered broken?
Yes, it is considered broken since SHA-1 collision has been found. On 23 February 2017, Google announced the first SHA-1 public collision using the SHAttered attack (100k faster than the brute force ...
- 647
11
votes
Do a 160-bit SHA-1 hash and a 160-bit slice of a SHA-256 hash have the same strength in terms of collision-free?
SHA-1 is broken in practice in terms of finding collisions. This shattered attack (identical-prefix collision attack) requires roughly $2^{63.1}$ SHA-1 evaluations and this is approximately 100,000 ...
- 47.6k
11
votes
Outlook of trustworthiness of SHA-2
AES-128 (2000) has been around for 20 years and there is no attack faster than brute-force, except the multi-target that affects all block ciphers and hash algorithms. As you can see, an algorithm can ...
- 47.6k
11
votes
How easy is it to fake a file hashed with three functions, CRC32, MD5 and SHA-1?
How easy is it to create a fake file-b that has the same hashes of file-a? crc32, md5 and sha1?
This is known in cryptographical circles as the 'second preimage' problem.
With CRC32, it's easy; just ...
- 145k
11
votes
Accepted
How secure is SHA-1 against preimage attacks currently?
To my knowledge, the SHA-1 hash function is still believed to have 160-bits of pre-image resistance against classical computation.
There have been results showing that reducing the number of rounds in ...
- 21.9k
Only top scored, non community-wiki answers of a minimum length are eligible