RFC 6194

Security Considerations for the SHA-0 and SHA-1 Message-Digest Algorithms ✨

okay bestie, this one is RFC 6194 🎀 and it's all about how SHA-0 and SHA-1 (hash algorithms) are kinda unsafe to rely on. it's Informational, not a Standards Track spec, so it's not a rulebook, more like a super smart warning from the IETF 💅

The crew: T. Polk, L. Chen, and S. Turner, with P. Hoffman, on March 2011. Polk, Chen, and Turner are from NIST (Polk and Chen) and IECA (Turner). Hoffman is from the VPN Consortium. The ISSN is 2070-1721. This RFC doesn't list any Obsoletes or Updates, so it doesn't replace or change any other RFC 🌸

Abstract

this doc is the security considerations for the SHA-0 and SHA-1 message digest algorithm. it's basically the "read this before you touch these" section 🔥

Status of This Memo

not a standards track spec. it's published for info purposes 📚

this is an IETF product 🌈 it reflects the consensus of the IETF community, got public review, and was approved for publication by the Internet Engineering Steering Group (IESG). not every IESG-approved doc is up for any level of Internet Standard, so check Section 2 of RFC 5741 if you're curious 🦋

for the current status, errata, or to leave feedback, check http://www.rfc-editor.org/info/rfc6194 ✨

Copyright Notice

Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved. 🎀

this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. read them carefully because they explain your rights and restrictions 🫶

if you pull code components out of this doc, they must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, same as the Simplified BSD License says 💜

1. Introduction 🌸

the Secure Hash Algorithms are specified in [SHS]. an older version of [SHS] also specified SHA-0. SHA-0 came out in 1993 and SHA-1 came out in 1996. both are message digest algorithms (aka hash functions or hash algorithms) that take a message of any length and spit out a 160-bit "fingerprint" or "message digest" 🔥

the published attacks on both show that it's not prudent to use either one where collision resistance is required. big yikes 💀

[HASH-Attack] sums up how hashes get used in Internet protocols and talks about how attacks on a digest's one-way and collision-free properties do and don't affect protocols. it's assumed you already know this one, so read it first 📚

some folks might find the key length and strength guidance in [SP800-57] and [SP800-131] useful 🧚

2. SHA-0 Security Considerations 🍓

this part is a recap of recent attacks on SHA-0's collision, pre-image, and second pre-image resistance. it also looks at SHA-0 used as a keyed hash, like HMAC-SHA-0 👑

the U.S. National Institute of Standards and Technology (NIST) withdrew SHA-0 in 1996. basically NIST stopped thinking it's appropriate for U.S. federal agencies to use SHA-0 for any crypto work protecting sensitive but unclassified info. SHA-0 is only included here for completeness 🙈

any use of SHA-0 is strongly discouraged. people still study it because a lot of them see it as a weaker version of SHA-1 🥀

2.1. Collision Resistance 💅

the first attack on SHA-0 was published in 1998 [CHJO1998], and it showed collisions could be found in 2^61 operations. in 2006, [NSSYK2006] came through with a better attack that finds collisions in 2^36 operations 😭

either way, the research says SHA-0 is nowhere near as collision resistant as it should be. its collision security strength is way lower than an ideal hash function, which is 2^36 compared to 2^80 🫠

2.2. Pre-Image and Second Pre-Image Resistance ✨

the pre-image and second pre-image attacks on reduced versions of SHA-0 (less than 80 rounds) suggest that SHA-0's security margin holds up against these. [deCARE2008] showed a pre-image attack on 49 out of 80 rounds with complexity 2^159, and [AOSA2009] showed one on 52 out of 80 rounds with complexity 2^156 🔍

2.3. HMAC-SHA-0 🎀

the current attacks on HMAC can be sorted into three buckets: distinguishing attacks, existential forgery attacks, and key recovery attacks. key recovery is the most severe by far 😤

attacks on hash functions can run completely offline, since the attacker can generate as many message-hash pairs as they want. attacks on HMACs have to be online, though, because the attacker needs a lot of HMAC values to figure out the key 🌈

the best partial key recovery attack on HMAC-SHA0 was published at Asiacrypt 2006, using 2^84 queries and 2^60 SHA-0 computations [COYI2006] 🦋

3. SHA-1 Security Considerations 💜

this part covers recent attacks on SHA-1's collision, pre-image, and second pre-image resistance. it also covers attacks on SHA-1 used as a keyed hash, which is HMAC-SHA-1 🌸

you have to know that NIST recommended SHA-1 not be used to generate digital signatures after December 31, 2010. it also said U.S. federal agencies must not use it to generate digital signatures "for the protection of sensitive, but unclassified information" after December 31, 2013 [SP800-131] 🔥

3.1. Collision Resistance ⭐

the first attack on SHA-1 was published in early 2005 [RIOS2005]. it was a theoretical attack on a version of SHA-1 cut down to 53 rounds 🧪

the very next month, [WLY2005] showed collisions in the full 80 rounds with 2^69 operations 😱

since then, lots of new analysis methods have popped up that try to improve on the attack in [WLY2005]. still, no published results beat [WLY2005] 🙅‍♀️

[Man2008/469] is the International Association for Cryptologic Research (IACR) ePrint version of [Man2009]. it claimed that, using the method in that paper, a collision of full SHA-1 can be found in 2^51 hash function calls. BUT that claim isn't in the published conference paper [Man2009], so be careful 👀

in any case, the research says SHA-1 is not as collision resistant as expected. its collision security strength is well below an ideal hash function, which is 2^69 compared to 2^80 🫣

3.2. Pre-Image and Second Pre-Image Resistance 🧚

there are no known pre-image or second pre-image attacks specific to the full-round SHA-1 algorithm 🙌

[KeSch] found a general result for all narrow-pipe Merkle-Damgaard hash functions, which includes SHA-1. finding a second pre-image takes less than 2^n computations. when n = 160 (like SHA-1), it takes 2^106 computations to find a second pre-image in a 60-byte message 🔢

without full-round attacks, cryptographers look at reduced-round attacks for clues about an algorithm's strength. reduced-round attacks, where the number of reduced rounds is not more than a few less than the full count, haven't been shown to carry over to full-round attacks. still, the best reduced-round attack does tell you about a security margin. for example, if the best known attack hits 60 out of 80 rounds, then the algorithm has about 20 rounds left to resist improved attacks 🌈

BUT the relationship between how many rounds an attack reaches and how many rounds the algorithm defines is not linear, and it's not a mathematical proof. reduced-round attacks show how strong an algorithm is against a certain attack, not how close it is to being broken. so the info below about reduced-round attacks is only here for completeness 🙈

the pre-image and second pre-image attacks on reduced versions of SHA-1 (less than 80 rounds) show that SHA-1 keeps a significant security margin against them. [AOSA2009] showed a pre-image attack on 48 out of 80 rounds with complexity 2^159 💖

3.3. HMAC-SHA-1 🦋

as of today, there's no sign that attacks on SHA-1 can be extended to HMAC-SHA-1 🫶

7. Normative References ✨

okay so this is the reading list bestie 📚🎀 every single source the RFC leans on, listed with all the deets so nobody has to go hunting. I'm keeping every title, author, venue, and date exactly as written, because that's literally the whole point of a reference list 💅

• [AOSA2009] Aoki, K., and K. Saski, "Meet-in-the-Middle Preimage Attacks Against Reduced SHA-0 and SHA-1", Crypto 2009.
• [deCARE2008] De Canniere, C., and C. Rechberger, "Preimages for Reduced SHA-0 and SHA-1", Crypto 2008.
• [CHJO1998] Chaubad, F., and A. Joux, "Differential Collisions in SHA-0", Crypto 1998.
• [COYI2006] Contini, S., and Y. Lin, "Forgery and Partial Key-Recovery Attacks on HMAC and NMAC Using Hash Collisions", Asiacrypt 2006.
• [HASH-Attack] Hoffman, P. and B. Schneier, "Attacks on Cryptographic Hashes in Internet Protocols", RFC 4270, November 2005.
• [KeSch] Kelsey, J., and B. Schneier, "Second Preimages on n-Bit Hash Functions for Much Less than 2n Work", In Cramer, R., ed.: Eurocrypt 2005. Volume 3494 of Lecture Notes in Computer Science, Springer (2005) 474-490.
• [Man2008/469] Manuell, S., "Classification and Generation of Disturbance Vectors for Collision Attacks against SHA-1", http://eprint.iacr.org/2008/469.pdf.
• [Man2009] Manuell, S., "Classification and Generation of Disturbance Vectors for Collision Attacks against SHA-1", International Workshop on Coding and Cryptography, 2009, Norway.
• [NSSYK2006] Naito, Y., Sasaki, Y., Shimoyama, T., Yajima, J., Kunihiro, N., and K. Ohta, "Improved Collision Search for SHA-0", Asiacrypt 2006.
• [RIOS2005] Rijmen, V., and E. Oswald, "Update on SHA-1", CT-RSA 2005, Lecture Notes in Computer Science, vol. 3376, pp. 58-71.
• [SHS] National Institute of Standards and Technology (NIST), FIPS Publication 180-3: Secure Hash Standard, October 2008.
• [SP800-57] National Institute of Standards and Technology (NIST), Special Publication 800-57: Recommendation for Key Management - Part 1 (Revised), March 2007.
• [SP800-107] National Institute of Standards and Technology (NIST), Special Publication 800-107: Recommendation for Applications using Approved Hash Algorithms, February 2009.
• [SP800-131] National Institute of Standards and Technology (NIST), Special Publication 800-131A: Recommendation for the Transitioning of Cryptographic Algorithms and Key Sizes, January 2011.
• [WLY2005] Wang, X., Yin, Y., and H. Yu., "Finding Collisions in the Full SHA-1", Crypto 2005.

Authors' Addresses 🦋

Tim Polk 💖 National Institute of Standards and Technology 100 Bureau Drive, Mail Stop 8930 Gaithersburg, MD 20899-8930 USA

EMail: tim.polk@nist.gov

Lily Chen 🌸 National Institute of Standards and Technology 100 Bureau Drive, Mail Stop 8930 Gaithersburg, MD 20899-8930 USA

EMail: lily.chen@nist.gov

Sean Turner 🧚 IECA, Inc. 3057 Nutley Street, Suite 106 Fairfax, VA 22031 USA

EMail: turners@ieca.com

Paul Hoffman 💜 VPN Consortium

EMail: paul.hoffman@vpnc.org

---

That's the whole RFC, bestie! 🌈✨ every reference is there, every author's contact is there, and nothing got softened or skipped. Main character energy for the standards world, periodt 👑💅