I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying function of my hash-based signature. But I'm not sure if it still makes sense to use SHA1 due to its vulnerabilities. Is there a scenario in which would be acceptable to use SHA1?

  • I think this should be better asked at crypto.stackexchange.com. If you look at Hash-based Signatures: An Outline for a New Standard you will find at page 3 that "while MSS requires a collision resistant hash function, XMSS reduces this requirement to weaker security assumptions...at MD5 and SHA1, there exist ‘practical’ collision attacks while the weaker properties XMSS uses (like second-preimage resistance) are still unbroken and there is not much progress in this direction so far" – Steffen Ullrich Jun 26 '17 at 17:38
  • @SteffenUllrich thanks for the tips! I'll check this paper. – Jéssica Carneiro Jun 26 '17 at 17:50

My answer would always be "in comparison to what else?"

In this moment, SHA-1 is weaker than SHA-2:


It's got known weaknesses, a smaller number of security bits, increased risk of collisions, and SHA-2 is fairly prolific, has a good performance, and is fairly widely accepted. So... why not use something better?

There is a reason - compatibility. There will always be some suitably old technology out there that simply cannot (or has not) been upgraded to use the current recommended best practice. So the big question is - does your business model benefit more from interoperability, or cryptographic strength?

My not-spending-lots-of-time-doing-math-research answer on SHA-1 vs. SHA-2 would be that it's a no brainer - SHA-2 is better. But if you told me that your biggest customer has a substantial investment in SHA-1 only technology and can't improve the system... well... I'd probably advise finding a way to limit the scope of where and who you do SHA-1 with, and then make sure you have that customer sign a nice sounding waiver that they understand that you can't be entirely responsible for the risks of using a not-best-practices algorithm.


The risk of using any algorithm is down to your risk appetite. Only you know if the risk of a SHA1 attack is something you are willing to accept.

I would use it if that was the only option for none mission critical or sensitive data. But that's only a personal opinion.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.