« Previous 1 2
SHA-3 – The new hash standard
Die Hard
Conclusions
You are unlikely to encounter security problems with SHA-1 today, but the experience with MD5 teaches us that migration from vulnerable algorithms can take a long time. Despite the fact that security issues had been known since 1996, it was not until the Flame virus successfully attacked the MD5 signatures of the Windows Update Service in 2012 – 16 years later – that many authorities began to address the problem.
Initial collisions are likely to be reported for SHA-1 in the next few years. However, the type of collision is important for the success of an attack: The problems with MD5 did not become relevant until attackers succeeded in creating meaningful data, such as certificates, with a collision. But, it did not take long for the problems with MD5 to become evident, and the attacks soon became more serious.
Infos
- SHA-3 competition by NIST: http://csrc.nist.gov/groups/ST/hash/sha-3/
- Keccak algorithm: http://keccak.noekeon.org/
- All proposals in the SHA-3 competition: http://ehash.iaik.tugraz.at/wiki/The_SHA-3_Zoo
- Bruce Schneier's blog entry: http://www.schneier.com/blog/archives/2012/09/sha-3_will_be_a.html
- Talk at 25C3 about spoofed MD5 signatures: http://media.ccc.de/browse/congress/2008/25c3-3023-en-making_the_theoretical_possible.html
- Analysis of the MD5 collision in the Flame virus: http://www.research.leiden.edu/news/cryptanalyst.html
« Previous 1 2
Buy ADMIN Magazine
US / Canada
UK / Australia
Related content
-
SHA-3 – The New Hash Standard
NIST has chosen the Keccak algorithm as the new cryptographic hash standard, but in real life, many users are still waiting to move to its predecessor, SHA-2.
-
The end of SHA-1
The SHA-1 cryptographic hash function has been considered insecure for a long time. Some Linux distributions have banned or no longer use it – with some consequences, though. -
TLS 1.3 and the return of common sense
After a decade in service, TLS 1.2 is showing many signs of aging. Its immediate successor, TLS 1.3, has earned the approval of the IETF. Some major changes are on the way. - NIST Says Use of SHA-1 Algorithm No Longer Advisable
-
Open source forensics for adaptive detection of threats on CRITIS networks
The open source tool Velociraptor is at the heart of a solution that automatically detects cyber threats in industrial environments, offering a defensive strategy and protecting critical infrastructures.