4 ms·

The article reports about the collision paper from 2004: http://unixwiz.net/techtips/iguide-crypto-hashes.html#bignews http://unixwiz.net/techtips/iguide-crypto

by cstuder 15y ago

The article reports about the collision paper from 2004: http://unixwiz.net/techtips/iguide-crypto-hashes.html#bignews http://unixwiz.net/techtips/iguide-crypto-hashes.html#bignew... And it seems to be written sometime in 2004, see the update and linked blogposts at the end. No need to yell.

aurelianito 15y ago
So, we agree that it is at least dated and we should not follow their advise as is. AFAIK sha256 is not broken yet, we can still use it.
- tptacek 15y ago
  Neither is SHA1. And even MD5 still survives in HMAC-MD5.
  - aurelianito 15y ago
    SHA1 has been reduced to a theoretical attack of 2^51 steps (http://eprint.iacr.org/2008/469.pdf http://eprint.iacr.org/2008/469.pdf) but no collision was found yet AFAIK. If I were choosing a hash function I would choose SHA256 over SHA1 unless the environment do not allow it.
    - tptacek 15y ago
      Nobody competent would disagree; SHA2 is better than SHA1, use SHA2. But in the real world, these distinctions matter a lot. Protocols fielded using SHA1 to glue together crypto primitives are unlikely to broken soon (often for the simple reason that they're used in hardened constructs like HMAC). Again: I don't even think there's a tractable way to break an otherwise sound protocol using HMAC-MD5 using MD5 flaws, today. It all depends on the context. Bare MD5 is probably fine as a mixing function for an RNG. It's probably (I haven't thought this through carefully) also fine for a stretched password hash. But should MD5 be one of your go-to functions? Of course not. Should SHA-1? Well, let me put it to you this way: if you contracted my company to assess your application and we found you using SHA-1 somewhere, we by default would not be able to write you up for it. It wouldn't actually be a vulnerability. (If you asked us specifically to review your crypto for best practices compliance, we would of course recommend you change it).
- cstuder 15y ago
  Yes, the advice is outdated. One of the perils of no clear publishing date. But the illustration of a hash function is still nice.
  - latortuga 15y ago
    According to the site, it was added "2004/08/22" and updated in February and May of 2005.
deleted 15y ago
[deleted]

by cstuder 15y ago

aurelianito 15y ago

So, we agree that it is at least dated and we should not follow their advise as is. AFAIK sha256 is not broken yet, we can still use it.

tptacek 15y ago
Neither is SHA1. And even MD5 still survives in HMAC-MD5.
- aurelianito 15y ago
  SHA1 has been reduced to a theoretical attack of 2^51 steps (http://eprint.iacr.org/2008/469.pdf http://eprint.iacr.org/2008/469.pdf) but no collision was found yet AFAIK. If I were choosing a hash function I would choose SHA256 over SHA1 unless the environment do not allow it.
  - tptacek 15y ago
    Nobody competent would disagree; SHA2 is better than SHA1, use SHA2. But in the real world, these distinctions matter a lot. Protocols fielded using SHA1 to glue together crypto primitives are unlikely to broken soon (often for the simple reason that they're used in hardened constructs like HMAC). Again: I don't even think there's a tractable way to break an otherwise sound protocol using HMAC-MD5 using MD5 flaws, today. It all depends on the context. Bare MD5 is probably fine as a mixing function for an RNG. It's probably (I haven't thought this through carefully) also fine for a stretched password hash. But should MD5 be one of your go-to functions? Of course not. Should SHA-1? Well, let me put it to you this way: if you contracted my company to assess your application and we found you using SHA-1 somewhere, we by default would not be able to write you up for it. It wouldn't actually be a vulnerability. (If you asked us specifically to review your crypto for best practices compliance, we would of course recommend you change it).
cstuder 15y ago
Yes, the advice is outdated. One of the perils of no clear publishing date. But the illustration of a hash function is still nice.
- latortuga 15y ago
  According to the site, it was added "2004/08/22" and updated in February and May of 2005.

deleted 15y ago

[deleted]