2005/03/18 SHA-1

SHA is the Secure Hash Algorithm, an encryption method that is used in all sorts of things from ssh to vpn's. Hashing is simple enough to understand, but a hash used for cryptography has to have specific characteristics: it needs to be collision free (so that a particular key can't decrypt more than one message) and it needs to be one-way, so that you can't easily recreate the original message from the hashed version. The very first SHA apparently had problems in one of those areas, so it was replaced by SHA-1.

I happened across this recently: http://www.schneier.com/blog/archives/2005/02/cryptanalysis_o.html


Hate these ads?

The article says that SHA-1 encryption has been broken.. but don't panic yet, because it takes massive computing power to do so.

But.. yesterday's unimaginable resources are tomorrow's desktops. There's also the somewhat disturbing note that says:



Hash functions are the least-well-understood cryptographic primitive,
and hashing techniques are much less developed than encryption
techniques. Regularly there are surprising cryptographic results
in hashing. I have a paper, written with John Kelsey, that describes
an algorithm to find second preimages with SHA-1 -- a technique
that generalizes to almost all other hash functions -- in 2106 
calculations: much less than the 2160 calculations for brute force.
This attack is completely theoretical and not even remotely practical,
but it demonstrates that we still have a lot to learn about hashing.


Which might mean that some mathematician may have some sudden surprising insight that makes hashes as transparent as rot-13 cyphers.

As always, security remains a journey and not a destrination.



Comments /Words2005/2005_03_18.html


Add your comments

Enter your email address for automatic notification of new posts here
(be sure to whitelist 'feedburner.com' if you use spam filtering)

Or use any RSS reader

Delivered by FeedBurner


ad

Views for this page
Today This Week This Month This Year  Overall
1524292 1,264

Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more. We appreciate comments and article submissions.

Publishing your articles here

pavatar.jpg
More:
       - Security




Unix/Linux Consultants

Your ad here - $24.00 yearly!

http://www.schewanick.com SCO Unix, Solaris, Linx (various), PHP, MySQL, Apache, uniBasic, dL4, Perl, System Administration and more....


http://www.cleverminds.net Need expert advice? Want a second opinion? CleverMinds is a one-stop-shop for a wide range of technology solutions. We support Unix, Linux, SCO as well as CMS, ecom, blogs, podcasts, search engines consulting and more. Contact us at web2.0@cleverminds.net 0r (617) 894-1282


http://echo3.net/ Unix/Linux Custom Applications, Web Hosting, C/C++ Programming Courses









Change Congress


Related Posts