4 ms·

>The unanimous agreement among experts is that it's no longer safe in almost all security contexts. Except for the great many security contexts where chosen-pr

>The unanimous agreement among experts is that it's no longer safe in almost all security contexts. Except for the great many security contexts where chosen-prefix collisions are not problematic. NIST for example has suggested SHA-1 is acceptable for such applications ("Hash (B)") for "2019 - 2030 & beyond". * https://www.keylength.com/en/4/ https://www.keylength.com/en/4/

goalieca 6y ago
Another example is the mask generation function for rsa-oaep.
zaarn 6y ago
The german BSI does not recommend SHA1 and NIST only recommends it for 128bit security applications. And knowing if your application is not vulnerable to prefix attacks can be a bit of a challenge, depending on what you do. If you have to ask yourself what to use, you probably shouldn't be starting to use SHA1. If your application supports it, then you're good to go for "2020 - 2030 & beyond", otherwise I'd just go with SHA256/SHA3-256 or even SHA512/SHA3-512.
- upofadown 6y ago
  From the 2020 BSI report: >From a security-technical perspective, however, there is, according to present knowledge,no reason speaking against using it in constructions which do not require collision resistance...
  - zaarn 6y ago
    Just because there is no reason against using something doesn't mean it's a good idea. They recommend SHA256 and upwards, they see no reason that SHA1 must be removed immediately from some corners of cryptography, those are no conflicting viewpoints. Just don't use SHA1 unless you absolutely are forced to do so, not when you make something new from scratch that can use SHA256.
    - upofadown 6y ago
      For all we know using SHA-1 where collisions are not an issue is a good idea. This sort of question has already came up for MD5 used where collisions were not an issue. Everyone spent a lot of time, money and compatibility moving away from MD5. We were told to move to SHA-1 which is now broken in the same way. It was pointless effort caused by pointless hysteria. Now we have pointless SHA-1 hysteria...
      - zaarn 6y ago
        Maybe stop hardcoding cryptoalgo's so you have to spend a lot of money to migrate? This is why protocols like TLS support negotiations.
kd913 6y ago
Sorry but why exactly should NIST be trusted? https://projectbullrun.org/dual-ec/vulnerability.html https://projectbullrun.org/dual-ec/vulnerability.html It seems from many sources that NIST were pushing a backdoored RNG source for a while. The main source for the ssh-keys arch wiki even says not to trust NIST. https://wiki.archlinux.org/index.php/SSH_keys https://wiki.archlinux.org/index.php/SSH_keys https://stribika.github.io/2015/01/04/secure-secure-shell.html https://stribika.github.io/2015/01/04/secure-secure-shell.ht...

goalieca 6y ago

Another example is the mask generation function for rsa-oaep.

zaarn 6y ago

The german BSI does not recommend SHA1 and NIST only recommends it for 128bit security applications. And knowing if your application is not vulnerable to prefix attacks can be a bit of a challenge, depending on what you do. If you have to ask yourself what to use, you probably shouldn't be starting to use SHA1. If your application supports it, then you're good to go for "2020 - 2030 & beyond", otherwise I'd just go with SHA256/SHA3-256 or even SHA512/SHA3-512.

upofadown 6y ago
From the 2020 BSI report: >From a security-technical perspective, however, there is, according to present knowledge,no reason speaking against using it in constructions which do not require collision resistance...
- zaarn 6y ago
  Just because there is no reason against using something doesn't mean it's a good idea. They recommend SHA256 and upwards, they see no reason that SHA1 must be removed immediately from some corners of cryptography, those are no conflicting viewpoints. Just don't use SHA1 unless you absolutely are forced to do so, not when you make something new from scratch that can use SHA256.
  - upofadown 6y ago
    For all we know using SHA-1 where collisions are not an issue is a good idea. This sort of question has already came up for MD5 used where collisions were not an issue. Everyone spent a lot of time, money and compatibility moving away from MD5. We were told to move to SHA-1 which is now broken in the same way. It was pointless effort caused by pointless hysteria. Now we have pointless SHA-1 hysteria...
    - zaarn 6y ago
      Maybe stop hardcoding cryptoalgo's so you have to spend a lot of money to migrate? This is why protocols like TLS support negotiations.

kd913 6y ago

Sorry but why exactly should NIST be trusted? https://projectbullrun.org/dual-ec/vulnerability.html https://projectbullrun.org/dual-ec/vulnerability.html It seems from many sources that NIST were pushing a backdoored RNG source for a while. The main source for the ssh-keys arch wiki even says not to trust NIST. https://wiki.archlinux.org/index.php/SSH_keys https://wiki.archlinux.org/index.php/SSH_keys https://stribika.github.io/2015/01/04/secure-secure-shell.html https://stribika.github.io/2015/01/04/secure-secure-shell.ht...