bugtraq - Re: SHA-1 broken

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20050220215550.GI32195@gsmx07.alcatel.com.au>
Date: Mon, 21 Feb 2005 08:55:50 +1100
From: Peter Jeremy <peter.jeremy@...atel.com.au>
To: Anatole Shaw <shaw_bugtraq20050218@...oloop.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: SHA-1 broken

On 2005-Feb-19 00:42:56 -0500, Anatole Shaw <shaw_bugtraq20050218@...oloop.com> wrote:
>Sadly, there is no magic bullet for the SHA-1 problem.  Let me say, in
>classic Bugtraq style, that I believe the "temporary workaround for this
>vulnerability" is to move to SHA-512 as quickly as possible.

There are two difficulties with this.  Firstly, SHA-512 generates a
hash that is somewhat over 3 times the size of SHA-1 - this may
present problems in some cases.  It's definitely not going to be a
drop-in replacement.

Secondly, AFAIK, it's not yet clear that SHA-512 (or SHA-256) are
resistant to this break.  Whilst a 2^11 reduction in collision resistance
would be unimportant in SHA-512, given the close relationship between the
SHA-* family, it's possible that that the _all_ of the SHA-* family have
a collision resistance similar to SHA-1 - around 2^70.

I agree that an alternative to SHA-1 is required fairly quickly.  It's
less clear that SHA-512 is even a temporary work-around.  I believe
that the immediate reaction would be to prepare a plan on how to
quickly replace SHA-1 with an alternative hash algorithm (probably
with a different sized result) and be ready to implement it once an
alternative is identified.  If you do move to SHA-512 now, you should
probably be prepared to make another change in the near future.

>The only fix will be informed analysis of the new paper from the Chinese
>team (which hasn't even been released yet) and the informed development
>of a solid cryptographic response.

Agreed.

-- 
Peter Jeremy

This email may contain privileged/confidential information. You may not copy or disclose this email to anyone without the written permission of the sender.  If you have received this email in error please kindly delete this message and notify the sender.  Opinions expressed in this email are those of the sender and not necessarily the opinions of the employer. 

This email and any attached files should be scanned to detect viruses.  No liability will be accepted by the employer for loss or damage (whether caused by negligence or not) as a result of email transmission.