3 ms·

I've never heard of proprietary systems "customizing" SHA-1 "…to personalize the cryptography for a given customer, while retaining the security guarantees of t

• dead10ck 12y ago
  This is what confuses me. How would an attacker use these results against a target? Wouldn't they need to get the modified SHA-1 library onto the target's systems?
• fleitz 12y ago
  People with a poor understanding of crypto, generally the types of people who have NIH syndrome will reinvent cryptography. I've personally worked with NIH SSL systems based on the idea of XOR'ing the messages with the 3rd byte of a header field called 'CryptoKey' or something like that. There are all sorts of homebrew crypto systems out there in the wild, if you're lucky it's based on an actual algorithm, but mostly it's worst than an enigma machine. In the case of the system I was working with the 3rd byte of the message was always a : so I ditched the whole look at the header thing, and just XOR'd the 3rd byte with : to derived the 'key'.
• makomk 12y ago
  It's the kind of thing that does happen occasionally, yes. I think one of the Bitcoin clones uses a modified version of SHA-256 with modified round constants for example. Can't remember a SHA-1 example but there are some out there. As for why? Intentional incompatibility with the standard hash usually, often as security-by-obscurity or to lock users into using their products.