Online toolbox

What is sha1 encryption?

SHA-1 (Chinese name: Secure Hash Algorithm 1) is a cryptographic hash function designed by the National Security Agency and published as the Federal Data Processing Standard (FIPS) by the National Institute of Standards and Technology (NIST). SHA-1 can generate a 160-bit (20-byte) hash value called a message digest, which is typically presented as 40 hexadecimal digits.

What is the difference between sha1, sha256, sha384, and sha512?

The differences between sha1, sha256, sha384, and sha512 lie in the encryption algorithm, the length of the encrypted ciphertext and the difficulty of cracking. Relatively speaking, the encryption security of sha256 is already quite high.

Can sha1 encryption be cracked?

In view of the secret-breaking results of SHA-0, experts suggest that those who plan to use SHA-1 to implement cryptographic systems should also reconsider. After the announcement of the results of the CRYPTO meeting in 2004, NIST announced that they would gradually reduce their use of SHA-1 and replace it with SHA-2. In 2005, Rijmen and Oswald published attacks on the weaker version of SHA-1 (53 encryption loops instead of 80): finding collisions within the computational complexity of 2. In February 2005, Wang Xiaoyun, Yin Yiqun and Yu Hongbo published attacks on the full version of SHA-1. They can find a set of collisions with less than 2 computational complexity. Using the birthday attack method to find the collision requires a computational complexity of 2. The authors of this paper wrote: "our cryptographic analysis is based on differential attacks against SHA-0, approximate collisions, multi-chunk collisions, and message modification techniques for finding collisions from the MD5 algorithm. Without these powerful analytical tools, SHA-1 cannot be cracked. " In addition, the author also shows a cryptography of 58 encryption loops SHA-1, and a set of collisions are found within 2 units of operation. The paper on the complete attack method was presented at the CRYPTO conference in August 2005. Yin Yiqun stated in an interview: "generally speaking, we have found two weaknesses: one is that the pre-processing is not complex enough, and the other is that some mathematical operations in the first 20 cycles can cause unexpected security problems." At the end of the CRYPTO meeting on Aug. 17, 2005, Wang Xiaoyun, Yao Qizhi and Yao Chufeng once again published a more efficient SHA-1 attack method, which can find collisions within two computational complexities. At the CRYPTO conference in 2006, Christian Rechberger and Christophe De Cani è re announced that they could find a collision of SHA-1 under the condition of allowing an attacker to determine part of the original message. In the academic theory of cryptography, any attack method whose computational complexity is less than the computational complexity required by the violent search method can be regarded as a cryptographic method against the cryptosystem; but this does not mean that the cryptographic method has entered the stage of practical application. As far as the application level is concerned, the emergence of a new method of breaking secrets suggests that there may be improved versions that are more efficient and practical in the future. Although these practical versions of cryptography have not been born at all, it is necessary to develop stronger hashing algorithms to replace the old ones. In addition to the "collision" attack, there is another reverse translation attack (Pre-image attack), which deduces the original message from the hashed string; the severity of the reverse translation attack is more serious than the collision attack, but it is also more difficult. In many situations that will be applied to password hashing (such as the storage of user passwords, the digital signature of files, etc.), the impact of collision attacks is not very great. For example, an attacker may not just want to forge an identical document, but may want to modify the original document and attach a legal signature to fool the verifier who holds the public key. On the other hand, if the unencrypted user password can be reversed from the ciphertext, the attacker can use the password to log in to other users' accounts, which is not allowed in the password system. However, if there is a reverse translation attack, it is possible to get the password of the specified user as long as the string after the hash of the specified user's password is obtained (usually in the video file, and the original password information may not be disclosed). On February 23,2017, Google announced that it and CWI Amsterdam have jointly created two PDF files with the same SHA- 1 value but different contents, which means that the SHA-1 algorithm has been officially breached.