I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying function of my hash-based signature. But I'm not sure if it still makes sense to use SHA1 due to its vulnerabilities. Is there a scenario in which would be acceptable to use SHA1?

  • I think this should be better asked at crypto.stackexchange.com. If you look at Hash-based Signatures: An Outline for a New Standard you will find at page 3 that "while MSS requires a collision resistant hash function, XMSS reduces this requirement to weaker security assumptions...at MD5 and SHA1, there exist ‘practical’ collision attacks while the weaker properties XMSS uses (like second-preimage resistance) are still unbroken and there is not much progress in this direction so far" Commented Jun 26, 2017 at 17:38
  • @SteffenUllrich thanks for the tips! I'll check this paper.
    – jcarneiro
    Commented Jun 26, 2017 at 17:50

2 Answers 2


My answer would always be "in comparison to what else?"

In this moment, SHA-1 is weaker than SHA-2:


It's got known weaknesses, a smaller number of security bits, increased risk of collisions, and SHA-2 is fairly prolific, has a good performance, and is fairly widely accepted. So... why not use something better?

There is a reason - compatibility. There will always be some suitably old technology out there that simply cannot (or has not) been upgraded to use the current recommended best practice. So the big question is - does your business model benefit more from interoperability, or cryptographic strength?

My not-spending-lots-of-time-doing-math-research answer on SHA-1 vs. SHA-2 would be that it's a no brainer - SHA-2 is better. But if you told me that your biggest customer has a substantial investment in SHA-1 only technology and can't improve the system... well... I'd probably advise finding a way to limit the scope of where and who you do SHA-1 with, and then make sure you have that customer sign a nice sounding waiver that they understand that you can't be entirely responsible for the risks of using a not-best-practices algorithm.


The risk of using any algorithm is down to your risk appetite. Only you know if the risk of a SHA1 attack is something you are willing to accept.

I would use it if that was the only option for none mission critical or sensitive data. But that's only a personal opinion.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .