SHA-1 was standardized by the NSA. It appears to be possible to choose the constants in such a way that collisions can be derived easily. Yet, it is not easily possible to discover that the constants have been chosen in such a way.

Would it have been possible for the NSA to insert a backdoor into SHA-1 using this technique? Would there be any way to find out? Are there be any security implications regarding the standard SHA-1?

3 Answers 3


This attack is not about generating a modified SHA-1 that makes collisions easier, it's about generating a modified SHA-1 as part of the process of generating one specific collision. The modified hash function so produced is only useful for creating the single collision used in the generation process; it is no more vulnerable to collisions in general than ordinary SHA-1. See the bottom of page 5 of the research paper.

The constants in ordinary SHA-1 are the square roots of 2, 3, 5, and 10, times 2^30. Yes, it's possible that those four numbers were picked because they permit the creation of a single highly-valuable collision somewhere, but it's unlikely.


I cannot say if this method was used anywhere. That is probably hard to find out. However, it is not possible to use this technique to exploit already existing implementations of SHA-1 that have not been designed to be weak by purpose. SHA-1 is still safe to use (as safe as it was before). The paper you refer to only shows how, by using certain constants, you can make SHA-1 unsafe and get collisions more easily.

Let's say you have a binary program which uses SHA-1 for some kind of encryption. Theoretically it is possible that your program does not make use of a "safe" SHA-1 function but that the vendor (the NSA or whoever) wrote his own implementation and tweaked the constants accordingly or simply got it wrong by accident. Then the SHA-1 implementation of that specific program is unsafe.

However, if you have the source of a piece of software and probably even compiled it yourself you can check that the SHA-1 implementation is correct. If the software makes use of "official" implementations of SHA-1 which come with many programming languages (python, perl, java - you name it) there should be no problem.

This kind of attack is not something that can be used to attack already existing software - the software (the SHA-1 implementation it uses) has already to be compromised beforehand.


I think this question is opinionated, but here's my take.

SHA-1 is standardized. The constants used are described in RFC3174. That article describes modifying the constants of a SHA-1 implementation to induce collisions.

Now your question, were the constants in RFC3174 chosen in a way that NSA could produce collisions? You could ask this same question about any standard that has been derived in the last 20 years. If you modify something to act in a way it wasn't designed; yes malicious things can occur.

I would say that the odds in are in favor of no backdoor. It's been standardized for almost 15 years, too many people have implemented it, and too many people have analyzed it. The research paper says that they couldn't do the same procedure with the current constants. In my opinion, if SHA-1 was flawed/backdoored it would have been found by now. If you don't like it you can use something else.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .