We are currently integrating with a third party component in our web application. Part of this integration requires sending data over http. This is done via POST parameters. An additional parameter is included in the request which is a SHA1 hash of the other parameters, plus secret key, combined as follows:
A malicious user or man in the middle attack has access to the parameters and the output hash, but not the secret key which is not sent over http. I've been reading that SHA1 is considered weak and, with sufficient resources, broken. I'd like to understand more about the robustness of this setup and how SHA1 is weak.
My questions are as follows:
- An attacker could iterate over all possible combinations of secret key, creating a new hash until a matching hash was found. Once the secret key is found, modifying the data (and then generating a new hash) sent between us would be trivial and, crucially, undetectable. Are there other ways (other than brute forcing) of finding out the secret key? Brute forcing could be used against any algorithm, leading me to believe there is a better/faster/cheaper way to do this. In other words, how do attackers exploit the weaknesses of SHA1?
- If we are unable to get them to increase the security of their message by using SHA2 or SHA3, will a suitably long secret key with SHA1 protect us against any attacks?