SHA-1
SHA-1 is a 160-bit cryptographic hash function designed by the NSA; Google published the SHAttered collision in 2017, and it has been deprecated across standards.
Purpose
Provides a 160-bit message digest; once used for TLS certificates and Git, deprecated due to collision attacks.
Mechanism
Processes input in 512-bit blocks, maintaining a 160-bit state (five 32-bit words). Each block goes through 80 steps of nonlinear transforms updating the state. The 2017 SHAttered attack constructs a collision at about 2^63 complexity.
Use cases
- Git object hashing (migrating to SHA-256)
- HMAC-SHA1 (still secure)
- Legacy digital certificates
- Teaching examples
Examples
- Input
helloOutputaaf4c61ddcc5e8a2dabeede0f3bde2d0d4b2f2160 bits = 40 hex characters
Common errors
- Using SHA-1 for signatures in new systems
- Use SHA-256 or SHA-3
Related terms
MD5
MD5 is a 128-bit cryptographic hash function designed by Ronald Rivest; proven insecure by collision attacks, it is now used only for non-security purposes such as checksums. GLOSSARY
SHA-256
SHA-256 is the 256-bit-output member of the SHA-2 family, widely used in TLS, blockchains, and cryptographic applications, with no known practical attacks. GLOSSARY
SHA-512
SHA-512 is the 512-bit-output member of the SHA-2 family; faster than SHA-256 on 64-bit platforms, providing a higher security margin. GLOSSARY
Collision Resistance
Collision resistance is the property of a hash function that it is infeasible to find two distinct inputs producing the same hash output. The birthday attack dictates the required output length. GLOSSARY