1

There is so little info and so much confusion out there.

People often equate SHA2 as being SHA256; so then would SHA be 160 bit, also known as SHA1?

Is SHA deprecated, like SHA1?

Are they the same thing?

What is the difference, anyway?

Does a deprecated SHA1 mean one should consider disabling SCHANNEL\Hashes\SHA?

Improve this question
4
  • Is sha sha-0? I looked up sha vs sha1, never found anything.
    – Tyler
    Apr 13, 2018 at 3:34
  • This is all I have found, still doesn't answer my question conclusively SHA stands for Secure Hashing Algorithm. SHA-1 and SHA-2 are two different versions of that algorithm. They differ in both construction (how the resulting hash is created from the original data) and in the bit-length of the signature. You should think of SHA-2 as the successor to SHA-1, as it is an overall improvement.
    – Tyler
    Apr 13, 2018 at 3:37
  • Cont: Primarily, people focus on the bit-length as the important distinction. SHA-1 is a 160-bit hash. SHA-2 is actually a “family” of hashes and comes in a variety of lengths, the most popular being 256-bit.
    – Tyler
    Apr 13, 2018 at 3:37
  • Cont: The variety of SHA-2 hashes can lead to a bit of confusion, as websites and authors express them differently. If you see “SHA-2,” “SHA-256” or “SHA-256 bit,” those names are referring to the same thing. If you see “SHA-224,” “SHA-384,” or “SHA-512,” those are referring to the alternate bit-lengths of SHA-2. You may also see some sites being more explicit and writing out both the algorithm and bit-length, such as “SHA-2 384.”
    – Tyler
    Apr 13, 2018 at 3:37

1 Answer 1

Reset to default
3

People often equate SHA2 as being SHA256...

Do they? While this is not fully true it is not fully wrong: SHA-256 is part of the SHA-2 family which also includes SHA-512 and others. See What is the relationship between “SHA-2” and “SHA-256”

... so then would SHA be 160 bit? AKA SHA1?

SHA is originally not SHA-1 but SHA-0. From Wikipedia:Secure Hash Algorithms:

SHA-0: A retronym applied to the original version of the 160-bit hash function published in 1993 under the name "SHA". It was withdrawn shortly after publication due to an undisclosed "significant flaw" and replaced by the slightly revised version SHA-1.

Despite this SHA-1 is often simply called SHA, like in cipher names like TLS_RSA_WITH_AES_128_CBC_SHA.

Does a depreciated SHA1 mean one should consider disabling SCHANNEL\Hashes\SHA?

This setting seems to affect the availability of SHA-1 in older versions of Windows (up to Windows 2003). But not every use of SHA-1 is bad. While it is no longer considered secure enough to be used for signing X.509 certificates used by TLS it is still considered safe to be used as HMAC as used in ciphers like TLS_RSA_WITH_AES_128_CBC_SHA. See Will Google block HMAC-SHA1 along with SHA1 signed certificates?. Thus, disabling SHA-1 in general using this registry key is not recommended (but it is probably recommended to use a newer version of Windows than Windows 2003).

Improve this answer
19
  • Thank you so much for your comment, it is so much appreciated. The only time I have noticed the use of sha-hmac so far was using NordVPN; current VPN is not using this; so I will certainly consider blocking sha under schannel.
    – Tyler
    Apr 13, 2018 at 4:19
  • @Tyler: SHA-1 is still heavily used as HMAC in ciphers within TLS. It might also have other valid use cases. Blocking the algorithm in general might cause strange problems without effectively increasing the security.
    – Steffen Ullrich
    Apr 13, 2018 at 4:24
  • 1
    Here is a registry file I made to do enable highest security for all devices I have just described in the above comment, also you can remove everything creating a reg file with the second half of the file: pastebin.com/Rrp6JbUR
    – Tyler
    Apr 13, 2018 at 6:19
  • 1
    It would IMO make sense to add that SHA is not one "family" of algorithms, but totally different (especially SHA-3) algorithms wich are somehow selected and then choose to be the new SHA now. While SHA-0/1/2 are quite similar, SHA-3 is totally different and not just a "better SHA-2".
    – Josef
    Apr 13, 2018 at 9:41
  • 1
    I am not seeing hmac anywhere in the default lists within windows or recommended lists online anywhere.
    – Tyler
    Apr 13, 2018 at 21:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .