I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying function of my hash-based signature. But I'm not sure if it still makes sense to use SHA1 due to its vulnerabilities. Is there a scenario in which would be acceptable to use SHA1?
2
-
I think this should be better asked at crypto.stackexchange.com. If you look at Hash-based Signatures: An Outline for a New Standard you will find at page 3 that "while MSS requires a collision resistant hash function, XMSS reduces this requirement to weaker security assumptions...at MD5 and SHA1, there exist ‘practical’ collision attacks while the weaker properties XMSS uses (like second-preimage resistance) are still unbroken and there is not much progress in this direction so far"– Steffen UllrichCommented Jun 26, 2017 at 17:38
-
@SteffenUllrich thanks for the tips! I'll check this paper.– jcarneiroCommented Jun 26, 2017 at 17:50
Add a comment
|
2 Answers
My answer would always be "in comparison to what else?"
In this moment, SHA-1 is weaker than SHA-2:
https://en.wikipedia.org/wiki/Secure_Hash_Algorithms
It's got known weaknesses, a smaller number of security bits, increased risk of collisions, and SHA-2 is fairly prolific, has a good performance, and is fairly widely accepted. So... why not use something better?
There is a reason - compatibility. There will always be some suitably old technology out there that simply cannot (or has not) been upgraded to use the current recommended best practice. So the big question is - does your business model benefit more from interoperability, or cryptographic strength?
My not-spending-lots-of-time-doing-math-research answer on SHA-1 vs. SHA-2 would be that it's a no brainer - SHA-2 is better. But if you told me that your biggest customer has a substantial investment in SHA-1 only technology and can't improve the system... well... I'd probably advise finding a way to limit the scope of where and who you do SHA-1 with, and then make sure you have that customer sign a nice sounding waiver that they understand that you can't be entirely responsible for the risks of using a not-best-practices algorithm.
answered Jun 26, 2017 at 19:50
The risk of using any algorithm is down to your risk appetite. Only you know if the risk of a SHA1 attack is something you are willing to accept.
I would use it if that was the only option for none mission critical or sensitive data. But that's only a personal opinion.
