Tim Wang's eLearning Blog

The two well known “non-crackable” hashing schemes have been successfully de-ciphered by a team of computer scientists in Shandong University, China. This surprised the cryptography community [and possibly the NSA] with an threat of implemeting a new scheme in the coming year. The SHA-1 function is widely used for digital signatures in such applications as e-mail and Web browsers. The SHA-1 function produces a hash 160 bits long. In theory, it should take 2^80 comparisons before two identical, random message hash results are found. That is several years' work for a huge number of cooperating PCs or one very powerful supercomputer. The recent SHA-1 break is a collision in which two random, non-meaningful messages were found to have the same hash in 2^69 comparisons, or about 2000 times faster than the brute-force method. That is still a very long job. Furthermore, the researchers applied some constraints on what the input message can look like in order to achieve this result. The National Institute of Standards and Technology [NIST] previously recommended migration to SHA-2 by 2010.