SHA-1 (Secure Hash Algorithm 1) Hash Function Broken Again by Researchers

Researchers from Google and the CWI Institute revealed that they had found a consistent way to break the cryptographic hash function SHA-1 (Secure Hash Algorithm 1) during a recent demonstration.

The Secure Hash Algorithm is a family of cryptographic hash functions published by the National Institute of Standards and Technology (NIST) as a U.S. Federal Information Processing Standard (FIPS) which includes:

• SHA-1: A 160-bit hash function which resembles the earlier MD5 algorithm. This was designed by the National Security Agency (NSA) to be part of the Digital Signature Algorithm. Cryptographic weaknesses were discovered in SHA-1, and the standard was no longer approved for most cryptographic uses after 2010.
• SHA-2: A family of two similar hash functions, with different block sizes, known as SHA-256 and SHA-512. They differ in the word size; SHA-256 uses 32 byte words where SHA-512 uses 64 byte words. There are also truncated versions of each standard, known as SHA-224, SHA-384, SHA-512/224 and SHA-512/256. These were also designed by the NSA.
• SHA-3: A hash function formerly called Keccak, chosen in 2012 after a public competition among non-NSA designers. It supports the same hash lengths as SHA-2, and its internal structure differs significantly from the rest of the SHA family.

Even though SHA-1 has been considered out-of-date for a while now, and many browser vendors had planned on suspending SHA-1 based certificates this year due to its weaker crypto structure than the newer SHA-2 and SHA-3 standards.  This recent news should enforce the need to not use SHA-1 as part of security operations.

Google and CWI engineered a collision attack against SHA-1, demonstrating two PDF files with the same SHA-1 hash and different content as a proof-of-concept of their findings.