Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What's some good advice on eliminating collisions when hashing things? I need a unique identifier for all my users, but I want them to be private. I'm thinking of using ODIN-1 (https://code.google.com/p/odinmobile/wiki/ODIN1), a sha1 of different device-specific identifiers; MAC for iOS, AndroidID for Android and DeviceUniqueId for Windows Phone.

However, what's the collision risk on those hashes? Would using another hashing function help? Another input? Platform-specific prefix? I really need every legitimate hash to be unique.

Let's ignore users who fake their hashes for now, since I cannot really do that much about them. Client side security is what it is.

share|improve this question
    
You need a unique identifier. Why does it have to be derived from anything? Why not a UUID? –  Stephen Touset Apr 15 at 7:42

1 Answer 1

up vote 1 down vote accepted

See Comparison of SHA functions on Wikipedia. As the table shows, a theoretical collision attack with an estimated complexity of ~2^69 exists for SHA-1. See Marc Stevens' presentation for reference.

Since you're concerned about collisions I recommend using SHA-2 instead. You can choose any of the variants, but I suggest you pick one that meets your security and performance requirements.

share|improve this answer
    
sha256? is that enough to eliminate collisions for a 48bit input? –  Filip Haglund Apr 15 at 6:34
    
According to the Wikipedia article, yes. Collision's don't occur with SHA-2. You could choose any of the variants, but I suggest you pick one that meets your security and performance requirements. –  Steven Volckaert Apr 15 at 6:48
    
Well, hashes are only hashed client-side, once, so by that logic I should use the toughest hash I can come up with? –  Filip Haglund Apr 15 at 7:12
2  
You are worrying about a made-up problem. Given a 48-bit input, you nor any of your users are ever going to experience a collision in any of the SHA-2 variants. –  Stephen Touset Apr 15 at 7:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.