Chosen-prefix collision for SHA-1 (2019)(sha-mbles.github.io) |
Chosen-prefix collision for SHA-1 (2019)(sha-mbles.github.io) |
How are other algorithms fairing recently, anything else started tumbling over in the last few years?
TL;DR: If all you need is a fast cryptographic digest, SHA-2 is still the gold standard. If you care about length-extension attacks, SHA-3's construction prevents them. If you're hashing passwords, you should use a KDF instead.
[1]: https://www.imperialviolet.org/2017/05/31/skipsha3.html
Truncated SHA-2, eg SHA-512/256, has some resistance against length extension attacks[1] while non-truncated has none, so wouldn't that be the gold standard?
edit: Thinking a bit more, I guess there are a lot of interesting cases which are not prone to length extension attacks where the full SHA-512 would be better.
[1]: https://en.wikipedia.org/wiki/SHA-2#Comparison_of_SHA_functi...
The earliest copy in the Wayback Machine is from 2020-01-07. That's also when it was first submitted to HN: https://news.ycombinator.com/item?id=21979333 (354 comments)
My guess is that it’s a truncated md5(secret + data) or hmac. Either way, with a sufficient long a secret, I won’t be able to guess it (offline), and because of the truncation, length extensions also out of the question.
With only 48 bits of entropy, I can’t shake the feeling that there are practical attacks I have not considered.