Is SHA-1 encryption?

Question

I have read that SHA-1 is a cryptographic hash function. On an exam, SHA-1 was given as a possible one-way encryption algorithm. Does SHA-1 require a key as input? Is a key required to qualify as "encryption"?

Answer 1

This could easily be googled or wikipedia'd, but here goes:

SHA-1 is a cryptographic hash function, but is not an encryption function. All you work the SHA-1 function on is irreversible.

SHA-1 could be done using a key, but that would make it a Message Authentication Code (MAC, see HMAC).

I agree with your last sentence. For something to be encrypted, you'll need to have some key, or something that corresponds to one. Say you have a (rather lousy) encryption function flipping the bits of the input, your key is "flip each bit". Another function may be a feistel network using the round function F, and a key K = 281474976710656 as input to that function.

Answer 2

By definition, a hash function is not encryption.

Encryption is the process of encoding messages (or information) in such a way that eavesdroppers cannot read it, but that authorized parties can.

and

Hash function is an algorithm that takes an arbitrary block of data and returns a fixed-size bit string, the cryptographic hash value, such that any change to the data will (with very high probability) change the hash value.

Encryption provides confidentiality while hash functions provide integrity.

Hash functions are used alongside encryption for their integrity capabilities.

Answer 3

There is an incorrect but widespread usage of the term "encryption" for things which are not encryption, but, for instance, hashing.

The strict definition of encryption assumes that some data is transformed, in a way such that:

• after the transformation, data is not readable anymore;
• there exists a reverse process, called decryption, which can recover the original data from the encrypted output, using the knowledge of some extra piece of data which is not publicly known.

It is somehow necessary for encryption that the encryption process uses a parameter which is linked to the secret data used for decryption; that parameter, we call a key. When the key for encryption is identical to the secret data used for decryption, then this is symmetric encryption. When the encryption key is mathematically linked with the secret data but yet distinct, in such a way that the encryption key can be safely made public, then this is asymmetric encryption.

Thus, there can be no such thing as "one-way encryption", and SHA-1 is not encryption. SHA-1 is hashing: no key, fixed-size output (160 bits for SHA-1), no reverse process (in particular, the input can be quite larger than the 160 output bits).

Unfortunately, the people who wrote your exam question apparently used the incorrect terminology; best thing to do is to follow their terminology for the duration of the exam. This is the same confusion which leads some people to talk about "encrypted passwords" for passwords which are actually hashed.

Answer 4

SHA-1 is not an encryption algorithm, it is a hash function. I will tell you the difference. A cryptographic function is getting text and key as input. Using the key. perform some algorithm on the plain text and then gives output as encrypted text. Consider if you give 'abcdef' as input and '123' as key it will return a encrypted text of 'abc' using an algorithm like DES, AES etc. This requires a key. It is like putting text in a box and locking the box using a key. The output size will vary according to the input size. That is if you give 1000 characters to encrypt you will get encrypted text having similar size. Size may vary for some algorithms.

Hash function is not to encrypt values. The hash function is like index for values. Consider a simple scenario. I have a number N, and hash of that number is defined N%100. For example if I give N as 123 Hash of N is 123%100 that is 23, if N is 1245621345 then its hash will be 1245621345%100 that is 45. Please note whether i am giving small input or large input the hash will be fixed in length. Here it is 2 digits. In similar way SHA-1 will get input value and calculate its hash. all SHA-1 hash value will have 160 bits. That is whether you give single character or 100000 character, the output size will be 160 bits only. So SHA-1 don't need key. It is used for Authentication purpose. You can Google the uses of Hash functions.

Answer 5

SHA-1 is a hash function. Hash functions are intended to perform a "one-way transformation"; the original message cannot be recovered from the digest, at all. Therefore, whether SHA-1 constitutes "one-way encryption" depends on the definition of that term from your class. It could have several possible logical definitions depending on semantics:

• If "encryption" is intended to be synonymous with "obfuscation", and "one-way" means "irreversible by any means", then SHA-1, as a hash, would meet this (very loose) definition of the term.

  The implicitly required "key" could be taken to be the "salt", which is a component of most crypto hashes that changes the produced hash in a deterministic but unpredictable way, and is therefore required to be correct in order to reproduce the same hash from the same message. However, technically the salt as used for hashes is not a secret, like a key normally is.

• If "one-way encryption" == "keyed hash", then SHA-1, in its primitive form, does not meet the definition. However, SHA-1 can be used as the hash function of an HMAC, which is a "keyed hash" designed for message authentication (only the correct message, with the correct key, will produce the same HMAC). HMACs are used in a variety of security schemes, such as in authenticated cipher block modes or in zero-knowledge proofs. The SHA-1-based HMAC is, appropriately enough, named HMAC-SHA1.

• If "encryption" is defined as "a key-based, reversible method of obfuscation", then "one-way encryption" == "trapdoor encryption" aka "asymmetric encryption", which SHA-1 in any form is not. Two keys are used, either of which when used in the encryption algorithm produces a transformation on the message that is irreversible without knowledge of the other key. RSA and elliptic-curve algorithms are examples, not SHA-1.