3 ms·
First of all, this has nothing to do with passwords. Indeed, this may be a higher bar to cross, but higher bars are usually being crossed. For years we known t
by dchest 11y ago
First of all, this has nothing to do with passwords.
Indeed, this may be a higher bar to cross, but higher bars are usually being crossed. For years we known that RC4 had biases, but it was considered okay until we discovered that it was not okay after all. MD5 collisions led to rogue certificates.
It's not correct that SHA-2 is not enough to fix the issue. While they share some design structure, SHA-2 is not broken, while SHA-1 is. Also, the proposal for multiple hash functions isn't particularly good: collision resistance of many cascaded hash functions is not much better than the maximal resistance of one hash function used in the cascade.
It doesn't make sense to use a broken cryptographic hash function in a new project that does need cryptography. There are faster modern cryptographic hashes than SHA-1. And it doesn't make sense to use a broken cryptographic hash function in a new project that doesn't need cryptography. There are faster modern non-cryptographic hashes than SHA-1.
To be fair, I don't know why we even have a discussion about this if cryptographers say that SHA-1 shouldn't be used, and you're trying to defend this choice for exactly what reason?
- philsnow 11y ago> SHA-2 is not broken, while SHA-1 is this kind of bare statement benefits greatly from a citation > collision resistance of many cascaded hash functions is not much better than the maximal resistance of one hash function used in the cascade I don't think GP is suggesting including results of hashes in the contents to be hashed by subsequent hash functions, but rather calculating MD5(contents), SHA1(contents), SHA2(contents), FOO4(contents) etc, and then concatenating all the hashes together. Or am I misunderstanding and this kind of scheme is exactly the "cascading" that you're talking about ?
- dchest 11y ago> this kind of bare statement benefits greatly from a citation Seriously? > I don't think GP is suggesting including results of hashes in the contents to be hashed by subsequent hash functions, but rather calculating MD5(contents), SHA1(contents), SHA2(contents), FOO4(contents) etc, and then concatenating all the hashes together. Or am I misunderstanding and this kind of scheme is exactly the "cascading" that you're talking about ? Yes, this is cascading. See this paper: https://www.iacr.org/archive/crypto2004/31520306/multicollisions.pdf https://www.iacr.org/archive/crypto2004/31520306/multicollis...