PermaLinkMore Big News In The Crypto World: SHA-1 Is Broken
12:11:38 AM

A bit less than six months ago, I reported the news from that results made public at a conference in Santa Barbara showed that the MD5 and SHA-0 algorithms were broken. The fact that these two algorithms for calculating cryptographic hashes (a.k.a. message digests) were proven to be vulnerable to collisions with less than brute-force effort cast doubt on whether SHA-1 and MD2 were also vulnerable. SHA-1 is often used for digital signatures in X,509 certificates and the SSL protocol, and MD2 is used for digital signatures in Lotus Notes and Domino.

Bruce Schneier is now reporting that a paper showing that SHA-1 is vulnerable is circulating in the crypto community. This certainly increases the likelihood that MD2 is similarly flawed.

More than likely, however, there's no need to panic. As the RSA Conference is currently going on in San Francisco, I imagine that there must be considerable brainpower analyzing the implications even as I type this, but to reiterate what I said in the earlier article, Tte algorithms are broken because they don't meet the very rigorous standards set by the crypto community for hashes, but that does not necessarily mean that the algorithms don't still meet all the practical requirements of even the most extreme security environments. Finding a way to generate two messages that have the same hash is a much easier problem than finding a plausible message that generates the same hash as a specific message. The fact that the former can be done in less than brute force time does not necessarily imply that the latter can be done in less than brute force time, and it says even less about how one might develop an attack suitable for use against real messages. Only time will tell, but the clock is definitely ticking.

If it wasn't apparent six months ago, it should be now: it's time for the crypto community in general, and IBM in particular, to start planning for a transition to a next generation of cryptographic algorithms that create longer and stronger hashes that can be proven to be resistant to the types of attacks that SHA-0, SHA-1, and MD5 have fallen to.

This page has been accessed 266 times. .
Comments :v

1. vesoftware11/05/2013 10:32:25 PM

Agen Bola Promo 100% SBOBET IBCBET Casino Poker Tangkas Online
ITUPOKER.COM AGEN POKER ONLINE INDONESIA TERPERCAYA : Toko belanja online murah, Promo heboh jual barang hanya Rp 1,-

2. ylq jake08/17/2017 04:51:28 AM,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Enter Comments^

Email addresses provided are not made available on this site.

You can use UUB Code in your posts.

[b]bold[/b]  [i]italic[/i]  [u]underline[/u]  [s]strikethrough[/s]

URL's will be automatically converted to Links

:-x :cry: :laugh: :-( :cool: :huh: :-) :angry: :-D ;-) :-p :grin: :rolleyes: :-\ :emb: :lips: :-o
bold italic underline Strikethrough

Remember me    

Monthly Archive
Responses Elsewhere

About The Schwartz


All opinions expressed here are my own, and do not represent positions of my employer.