How secure is SHA-1 against preimage attacks currently?

Hormoz

11/30/23, 12:54 PM

We know that SHA-1 is susceptible to collision attacks, but what about pre-image attacks such as poisoning torrents?

1733

1 + 0

sha-1

preimage-resistance

Score:11

Crypto

Daniel S

11/30/23, 2:49 PM

To my knowledge, the SHA-1 hash function is still believed to have 160-bits of pre-image resistance against classical computation.

There have been results showing that reducing the number of rounds in SHA-1 to below the stipulated 80 allow pre-images to be found subexhaustively. Specifically, De Canniere and Rechberger's Crypto 2008 paper Preimages for Reduced SHA-0 and SHA-1 claim a pre-image attack taking on 44-round SHA-1 roughly $2^{157}$ evaluations. This seems to indicate that cryptanalysis is not yet close to a full pre-image attack.

Nevertheless, SHA-1 should be deprecated as the collision attack means that it should not be offered as a legacy option in cryptographic libraries in order to avoid downgrade attacks in applications where collision resistance is required.

+ 5

kodlu

11/30/23, 2:55 PM

thanks for this informative answer, so to my understanding the state of the art for pre-image (unlike collision) has not really improved.

forest

11/30/23, 11:31 PM

Even MD5 is quite preimage resistant (though you still shouldn't use it!).

Daniel S

12/1/23, 7:55 AM

@forest True, but also worth mentioning the impressive work by Sasaki and Aoki finding a [subexhaustive attack on MD5 preimage](https://iacr.org/archive/eurocrypt2009/54790136/54790136.pdf).

kelalaka

12/1/23, 2:00 PM

@kodlu collision attack is the first one to break since it gives the attacker more control.

kelalaka

12/2/23, 7:43 PM

@DanielS the MD5's attack's real cost is larger than the direct brute force in practice. The main reason is the memory cost. The attack's real cost must be counted with the memory cost, too, That is always mentioned by DJB. Consider the novel DES attacks ( linear and differential), they are faster, however, the real cost is much higher so that none ever build them, we have only brute-force attacks on DES.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How secure is SHA-1 against preimage attacks currently?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.