Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
120 votes
Accepted

How easy is it in 2022 to find a SHA1 collision?

According to some Hashcat benchmarks, a current Nvidia GPU can compute SHA-1 hashes at a rate of: NVIDIA GeForce RTX 3090 ~22.6×109 hashes per second NVIDIA GeForce RTX 3080 Ti ~21.7×109 hashes ...
Lery's user avatar
  • 7,699
85 votes
Accepted

What is the new attack on SHA-1 "SHAttered" and how does it work?

In order to get a collision on a $n$ bit Random Oracle using the birthday paradox, one needs $\sqrt{\pi / 2} \cdot 2^{n/2}$ calls. In other words, in the case of the 160 output bits of SHA-1 the limit ...
Biv's user avatar
  • 9,988
56 votes
Accepted

How secure is SHA1? What are the chances of a real exploit?

Actually SHA-1 has been "officially insecure" for a longer time, since an attack method was published in 2011. The 2017 collisions was just the first known case of actually running the attack. But ...
Thomas Pornin's user avatar
52 votes
Accepted

Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?

Yes, SHA1-signed certificates are unsafe. The SHAttered paper is instructive. From the introduction: The MD-SHA family of hash functions is the most well-known hash function family, which ...
Squeamish Ossifrage's user avatar
36 votes
Accepted

How are the functions used in cryptographic hash functions chosen?

The functions considered are binary functions of 3 bits to 1 bit (extended to bit vectors, that is bitwise functions). There are $2^{(2^3)}=256$ such functions. All the functions considered are ...
fgrieu's user avatar
  • 142k
34 votes
Accepted

After Google's collision attack, is RSA-SHA1 signature still safe?

The answer is "not safe". But it is not safe, regardless of Google's attack. Before Google attacked, we knew that SHA-1 is not the best choice. Google found one collision based on some existing, ...
Weikeng Chen's user avatar
32 votes

Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?

The existence of the SHAttered result is not, I think, in itself a surprise: everyone knows that in theory you can create two streams of bytes that hash to the same value. Google's achievements (which ...
Maarten Bodewes's user avatar
  • 93.1k
30 votes
Accepted

In 2020, SHA-1 practically broken in chosen-prefix collision (CP-collision). Can double SHA-1 hashing prevent CP-collision?

a. No such double hashing doesn't do a bit of good. Anything which collides after a single hash will definetly collide after a double hash. It preserves all collisions and adds new ones. We might ...
Meir Maor's user avatar
  • 11.8k
29 votes
Accepted

How reassuring is 64-bit (in)security?

TL;DR; Just give me the numbers; Machines in a second in an hour in a day in a year Summit on SHA-1 $\approx 2^{49.7} $ $ \approx 2^{61.5}$ $\approx 2^{66.1}$ $\approx 2^{74.6}$ Titan on SHA-1 $\...
kelalaka's user avatar
  • 48.8k
27 votes
Accepted

Why can't they just fix SHA-1 if it's broken?

I have 3 answers: We can't fix SHA-1, we shouldn't fix SHA-1 and we already did fix SHA-1. SHA-1 is a hash standard; many different people can and have implemented it and they all get the same results....
Meir Maor's user avatar
  • 11.8k
26 votes
Accepted

How many bits in the resultant hash will change, if the x bits are changed in its the original input?

For any one of the SHA hashes, the hash should be indistinguishable from pseudo-random. That means each and every bit flips with a chance of 50%. So on average half of the amount of bits gets flipped, ...
Maarten Bodewes's user avatar
  • 93.1k
25 votes
Accepted

How to get an output of SHA-1 with first 2-bit are zeros?

Hash random values until you get a hash with two leading zeroes. We would expect about 1 in 4 values to have a hash-value of that form. So let's try this: ...
Maeher's user avatar
  • 6,852
24 votes

What is the new attack on SHA-1 "SHAttered" and how does it work?

It is an approximately1 $2^{64}$ time identical-prefix collision attack on SHA-1 based on the same principles as Marc Stevens' earlier attacks on SHA-1. It is the first practical collision attack on ...
otus's user avatar
  • 32.1k
24 votes
Accepted

What is hardened SHA-1, how does it work and how much protection does it offer?

Hardened SHA-1 detects collisions built of a certain form, If someone were to find a collision using brute-force birthday attack (currently not feasible) the detection would not work. The vectors are ...
Meir Maor's user avatar
  • 11.8k
23 votes

Why can't they just fix SHA-1 if it's broken?

We can fix SHA-1 but why? SHA-1 is broken. We cannot fix it without modifying result (so compability won't be preserved). We can make changes that will fix it... for now, and also will make it ...
axapaxa's user avatar
  • 2,950
20 votes
Accepted

How hard is it to generate a simultaneous MD5 and SHA1 collision?

Surprisingly enough, it would appear that generating a simultaneous collision wouldn't be that much more expensive than generating a single collision for SHA-1. The basic idea is to form a $2^{64}$ ...
poncho's user avatar
  • 148k
20 votes

How reassuring is 64-bit (in)security?

There is a huge difference between $2^{-64}$ probability of failure, which is indeed very small, and having to run $2^{64}$ in order to carry out the attack. The latter is much too small to be ...
Yehuda Lindell's user avatar
20 votes
Accepted

Does a hash function have a Upper bound on input length?

Does hashing algorithms have an upper bound in the input space? They can, but they don't have to and it depends on their specification. All Merkle-Damgård based hash functions do have an upper limit,...
SEJPM's user avatar
  • 46.1k
16 votes

SHA-1 – Why is it hard to find a certificate collision?

Why is it it’s so much harder to execute a successful collision on certificates than it is on text data? It's not. Actually, the attacker does have to worry about the sequence number that the CA ...
poncho's user avatar
  • 148k
14 votes

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

They are all hash functions. Apart from that, they are structurally quite different. The SHA family (SHA-0, SHA-1, and the SHA-2 functions such as SHA-256 and SHA-512) use the Merkle-Damgård ...
Thomas Pornin's user avatar
13 votes
Accepted

Advantages/disadvantages of using symmetric encryption function as hash function?

The disadvantage of this approach is that block ciphers are not necessarily designed with this goal in mind. Specifically, AES has related-key problems, and DES completely breaks in Davies-Meyer. In ...
Yehuda Lindell's user avatar
13 votes

How to get an output of SHA-1 with first 2-bit are zeros?

This is an extension of Maeher's answer and the full code of this answer is in Github. Hash functions are expected to produce random output random in the sense that the value of the hash is basically ...
kelalaka's user avatar
  • 48.8k
12 votes

Why is SHA-1 considered broken?

Yes, it is considered broken since SHA-1 collision has been found. On 23 February 2017, Google announced the first SHA-1 public collision using the SHAttered attack (100k faster than the brute force ...
kenorb's user avatar
  • 657
12 votes
Accepted

Is SHA-1 secure when used to implement a PRNG

I read SHA1 is still a secured hashing function with no collision found as of now. You read an old text, this is not the case anymore since SHA-1 was SHAttered. In Java, we still use SHA1PRNG ...
Maarten Bodewes's user avatar
  • 93.1k
12 votes
Accepted

How secure is SHA-1 against preimage attacks currently?

To my knowledge, the SHA-1 hash function is still believed to have 160-bits of pre-image resistance against classical computation. There have been results showing that reducing the number of rounds in ...
Daniel S's user avatar
  • 23.9k
11 votes

Do a 160-bit SHA-1 hash and a 160-bit slice of a SHA-256 hash have the same strength in terms of collision-free?

SHA-1 is broken in practice in terms of finding collisions. This shattered attack (identical-prefix collision attack) requires roughly $2^{63.1}$ SHA-1 evaluations and this is approximately 100,000 ...
kelalaka's user avatar
  • 48.8k
11 votes

Outlook of trustworthiness of SHA-2

AES-128 (2000) has been around for 20 years and there is no attack faster than brute-force, except the multi-target that affects all block ciphers and hash algorithms. As you can see, an algorithm can ...
kelalaka's user avatar
  • 48.8k
11 votes

How easy is it to fake a file hashed with three functions, CRC32, MD5 and SHA-1?

How easy is it to create a fake file-b that has the same hashes of file-a? crc32, md5 and sha1? This is known in cryptographical circles as the 'second preimage' problem. With CRC32, it's easy; just ...
poncho's user avatar
  • 148k
10 votes
Accepted

Why does SHA-1 rotate the variables A and B?

Most the other operations you see in the round – XORs and $f_t$ – are bitwise functions. Without rotations every bit would only affect the corresponding bits in the other words and the higher bits in ...
otus's user avatar
  • 32.1k
10 votes

Is the SHA1 hash of MD5 hash of a password secure?

Pros: The only pro is that your method is very slightly better than storing passwords in plaintext. Cons: If an attacker gains access to your database, he will easily be able to recover 99% of ...
bkjvbx's user avatar
  • 1,554

Only top scored, non community-wiki answers of a minimum length are eligible