Contents 1 Development 2 Applications 2.1 Cryptography 2.2 Data integrity 3 Cryptanalysis and validation 3.1 Attacks 3.1.1 The SHAppening 3.1.2 SHAttered – first public collision 3.2 SHA-0 3.3 Official validation 4 Examples and pseudocode 4.1 Example hashes 4.2 SHA-1 pseudocode 5 Comparison of SHA functions 6 See also 7 Notes 8 References 9 External links

Development One iteration within the SHA-1 compression function: A, B, C, D and E are 32-bit words of the state; F is a nonlinear function that varies; n denotes a left bit rotation by n places; n varies for each operation; Wt is the expanded message word of round t; Kt is the round constant of round t; denotes addition modulo 232. SHA-1 produces a message digest based on principles similar to those used by Ronald L. Rivest of MIT in the design of the MD4 and MD5 message digest algorithms, but has a more conservative design. SHA-1 was developed as part of the U.S. Government's Capstone project.[17] The original specification of the algorithm was published in 1993 under the title Secure Hash Standard, FIPS PUB 180, by U.S. government standards agency NIST (National Institute of Standards and Technology).[18][19] This version is now often named SHA-0. It was withdrawn by the NSA shortly after publication and was superseded by the revised version, published in 1995 in FIPS PUB 180-1 and commonly designated SHA-1. SHA-1 differs from SHA-0 only by a single bitwise rotation in the message schedule of its compression function. According to the NSA, this was done to correct a flaw in the original algorithm which reduced its cryptographic security, but they did not provide any further explanation.[citation needed] Publicly available techniques did indeed compromise SHA-0 before SHA-1.[citation needed]

Applications Cryptography Further information: Cryptographic hash function § Applications SHA-1 forms part of several widely used security applications and protocols, including TLS and SSL, PGP, SSH, S/MIME, and IPsec. Those applications can also use MD5; both MD5 and SHA-1 are descended from MD4. The algorithm has also been used on Nintendo's Wii gaming console for signature verification when booting, but a significant flaw in the first implementations of the firmware allowed for an attacker to bypass the system's security scheme.[20] SHA-1 and SHA-2 are the hash algorithms required by law for use in certain U.S. government applications, including use within other cryptographic algorithms and protocols, for the protection of sensitive unclassified information. FIPS PUB 180-1 also encouraged adoption and use of SHA-1 by private and commercial organizations. SHA-1 is being retired from most government uses; the U.S. National Institute of Standards and Technology said, "Federal agencies should stop using SHA-1 for...applications that require collision resistance as soon as practical, and must use the SHA-2 family of hash functions for these applications after 2010" (emphasis in original),[21] though that was later relaxed.[22] A prime motivation for the publication of the Secure Hash Algorithm was the Digital Signature Standard, in which it is incorporated. The SHA hash functions have been used for the basis of the SHACAL block ciphers. Data integrity Revision control systems such as Git, Mercurial, and Monotone use SHA-1 not for security but to identify revisions and to ensure that the data has not changed due to accidental corruption. Linus Torvalds said about Git: If you have disk corruption, if you have DRAM corruption, if you have any kind of problems at all, Git will notice them. It's not a question of if, it's a guarantee. You can have people who try to be malicious. They won't succeed. ... Nobody has been able to break SHA-1, but the point is the SHA-1, as far as Git is concerned, isn't even a security feature. It's purely a consistency check. The security parts are elsewhere, so a lot of people assume that since Git uses SHA-1 and SHA-1 is used for cryptographically secure stuff, they think that, Okay, it's a huge security feature. It has nothing at all to do with security, it's just the best hash you can get. ... I guarantee you, if you put your data in Git, you can trust the fact that five years later, after it was converted from your hard disk to DVD to whatever new technology and you copied it along, five years later you can verify that the data you get back out is the exact same data you put in. ... One of the reasons I care is for the kernel, we had a break in on one of the BitKeeper sites where people tried to corrupt the kernel source code repositories.[23] However Git does not require the second preimage resistance of SHA-1 as a security feature, since it will always prefer to keep the earliest version of an object in case of collision, preventing an attacker from surreptitiously overwriting files.[24]

Examples and pseudocode Example hashes These are examples of SHA-1 message digests in hexadecimal and in Base64 binary to ASCII text encoding. SHA1("The quick brown fox jumps over the lazy dog") gives hexadecimal: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12 gives Base64 binary to ASCII text encoding: L9ThxnotKPzthJ7hu3bnORuT6xI= Even a small change in the message will, with overwhelming probability, result in many bits changing due to the avalanche effect. For example, changing dog to cog produces a hash with different values for 81 of the 160 bits: SHA1("The quick brown fox jumps over the lazy cog") gives hexadecimal: de9f2c7fd25e1b3afad3e85a0bd17d9b100db4b3 gives Base64 binary to ASCII text encoding: 3p8sf9JeGzr60+haC9F9mxANtLM= The hash of the zero-length string is: SHA1("") gives hexadecimal: da39a3ee5e6b4b0d3255bfef95601890afd80709 gives Base64 binary to ASCII text encoding: 2jmj7l5rSw0yVb/vlWAYkK/YBwk= SHA-1 pseudocode Pseudocode for the SHA-1 algorithm follows: Note 1: All variables are unsigned 32-bit quantities and wrap modulo 232 when calculating, except for ml, the message length, which is a 64-bit quantity, and hh, the message digest, which is a 160-bit quantity. Note 2: All constants in this pseudo code are in big endian. Within each word, the most significant byte is stored in the leftmost byte position Initialize variables: h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0 ml = message length in bits (always a multiple of the number of bits in a character). Pre-processing: append the bit '1' to the message e.g. by adding 0x80 if message length is a multiple of 8 bits. append 0 ≤ k < 512 bits '0', such that the resulting message length in bits is congruent to −64 ≡ 448 (mod 512) append ml, the original message length, as a 64-bit big-endian integer. Thus, the total length is a multiple of 512 bits. Process the message in successive 512-bit chunks: break message into 512-bit chunks for each chunk break chunk into sixteen 32-bit big-endian words w[i], 0 ≤ i ≤ 15 Extend the sixteen 32-bit words into eighty 32-bit words: for i from 16 to 79 w[i] = (w[i-3] xor w[i-8] xor w[i-14] xor w[i-16]) leftrotate 1 Initialize hash value for this chunk: a = h0 b = h1 c = h2 d = h3 e = h4 Main loop:[3][55] for i from 0 to 79 if 0 ≤ i ≤ 19 then f = (b and c) or ((not b) and d) k = 0x5A827999 else if 20 ≤ i ≤ 39 f = b xor c xor d k = 0x6ED9EBA1 else if 40 ≤ i ≤ 59 f = (b and c) or (b and d) or (c and d) k = 0x8F1BBCDC else if 60 ≤ i ≤ 79 f = b xor c xor d k = 0xCA62C1D6 temp = (a leftrotate 5) + f + e + k + w[i] e = d d = c c = b leftrotate 30 b = a a = temp Add this chunk's hash to result so far: h0 = h0 + a h1 = h1 + b h2 = h2 + c h3 = h3 + d h4 = h4 + e Produce the final hash value (big-endian) as a 160-bit number: hh = (h0 leftshift 128) or (h1 leftshift 96) or (h2 leftshift 64) or (h3 leftshift 32) or h4 The number hh is the message digest, which can be written in hexadecimal (base 16), but is often written using Base64 binary to ASCII text encoding. The constant values used are chosen to be nothing up my sleeve numbers: The four round constants k are 230 times the square roots of 2, 3, 5 and 10. The first four starting values for h0 through h3 are the same with the MD5 algorithm, and the fifth (for h4) is similar. Instead of the formulation from the original FIPS PUB 180-1 shown, the following equivalent expressions may be used to compute f in the main loop above: Bitwise choice between c and d, controlled by b. (0 ≤ i ≤ 19): f = d xor (b and (c xor d)) (alternative 1) (0 ≤ i ≤ 19): f = (b and c) xor ((not b) and d) (alternative 2) (0 ≤ i ≤ 19): f = (b and c) + ((not b) and d) (alternative 3) (0 ≤ i ≤ 19): f = vec_sel(d, c, b) (alternative 4) Bitwise majority function. (40 ≤ i ≤ 59): f = (b and c) or (d and (b or c)) (alternative 1) (40 ≤ i ≤ 59): f = (b and c) or (d and (b xor c)) (alternative 2) (40 ≤ i ≤ 59): f = (b and c) + (d and (b xor c)) (alternative 3) (40 ≤ i ≤ 59): f = (b and c) xor (b and d) xor (c and d) (alternative 4) (40 ≤ i ≤ 59): f = vec_sel(c, b, c xor d) (alternative 5) It was also shown[56] that for the rounds 32–79 the computation of: w[i] = (w[i-3] xor w[i-8] xor w[i-14] xor w[i-16]) leftrotate 1 can be replaced with: w[i] = (w[i-6] xor w[i-16] xor w[i-28] xor w[i-32]) leftrotate 2 This transformation keeps all operands 64-bit aligned and, by removing the dependency of w[i] on w[i-3], allows efficient SIMD implementation with a vector length of 4 like x86 SSE instructions.

Comparison of SHA functions In the table below, internal state means the "internal hash sum" after each compression of a data block. Further information: Merkle–Damgård construction Note that performance will vary not only between algorithms, but also with the specific implementation and hardware used. The OpenSSL tool has a built-in "speed" command that benchmarks the various algorithms on the user's system. view talk edit Comparison of SHA functions Algorithm and variant Output size (bits) Internal state size (bits) Block size (bits) Max message size (bits) Rounds Operations Security bits (Info) Capacity against length extension attacks Performance on Skylake (median cpb)[57] First Published long messages 8 bytes MD5 (as reference) 128 128 (4 × 32) 512 Unlimited[58] 64 And, Xor, Rot, Add (mod 232), Or <64 (collisions found) 0 4.99 55.00 1992 SHA-0 160 160 (5 × 32) 512 264 − 1 80 And, Xor, Rot, Add (mod 232), Or <34 (collisions found) 0 ≈ SHA-1 ≈ SHA-1 1993 SHA-1 <63 (collisions found[59]) 3.47 52.00 1995 SHA-2 SHA-224 SHA-256 224 256 256 (8 × 32) 512 264 − 1 64 And, Xor, Rot, Add (mod 232), Or, Shr 112 128 32 0 7.62 7.63 84.50 85.25 2004 2001 SHA-384 SHA-512 384 512 512 (8 × 64) 1024 2128 − 1 80 And, Xor, Rot, Add (mod 264), Or, Shr 192 256 128 (≤ 384) 0 5.12 5.06 135.75 135.50 SHA-512/224 SHA-512/256 224 256 112 128 288 256 ≈ SHA-384 ≈ SHA-384 SHA-3 SHA3-224 SHA3-256 SHA3-384 SHA3-512 224 256 384 512 1600 (5 × 5 × 64) 1152 1088 832 576 Unlimited[60] 24[61] And, Xor, Rot, Not 112 128 192 256 448 512 768 1024 8.12 8.59 11.06 15.88 154.25 155.50 164.00 164.00 2015 SHAKE128 SHAKE256 d (arbitrary) d (arbitrary) 1344 1088 min(d/2, 128) min(d/2, 256) 256 512 7.08 8.59 155.25 155.50

See also Collision (computer science) Comparison of cryptographic hash functions cryptlib Crypto++ Hash function security summary Hashcash International Association for Cryptologic Research Libgcrypt mbed TLS md5deep OpenSSL RIPEMD Secure Hash Standard sha1sum Tiger (cryptography) Trusted timestamping Whirlpool (cryptography)

References Florent Chabaud, Antoine Joux: Differential Collisions in SHA-0. CRYPTO 1998. pp56–71 Eli Biham, Rafi Chen, Near-Collisions of SHA-0, Cryptology ePrint Archive, Report 2004/146, 2004 (appeared on CRYPTO 2004), IACR.org Xiaoyun Wang, Hongbo Yu and Yiqun Lisa Yin, Efficient Collision Search Attacks on SHA-0, CRYPTO 2005, CMU.edu Xiaoyun Wang, Yiqun Lisa Yin and Hongbo Yu, Finding Collisions in the Full SHA-1, Crypto 2005 MIT.edu Henri Gilbert, Helena Handschuh: Security Analysis of SHA-256 and Sisters. Selected Areas in Cryptography 2003: pp175–193 unixwiz.net "Proposed Revision of Federal Information Processing Standard (FIPS) 180, Secure Hash Standard". Federal Register. 59 (131): 35317–35318. 1994-07-11. Retrieved 2007-04-26.  A. Cilardo, L. Esposito, A. Veniero, A. Mazzeo, V. Beltran, E. Ayugadé, A CellBE-based HPC application for the analysis of vulnerabilities in cryptographic hash functions, High Performance Computing and Communication international conference, August 2010

External links CSRC Cryptographic Toolkit – Official NIST site for the Secure Hash Standard FIPS 180-4: Secure Hash Standard (SHS) RFC 3174 (with sample C implementation) Interview with Yiqun Lisa Yin concerning the attack on SHA-1 Explanation of the successful attacks on SHA-1 (3 pages, 2006) Cryptography Research – Hash Collision Q&A Hash Project Web Site: software- and hardware-based cryptanalysis of SHA-1 SHA-1 at Curlie (based on DMOZ) Lecture on SHA-1 on YouTube by Christof Paar v t e Cryptographic hash functions & message authentication codes List Comparison Known attacks Common functions MD5 SHA-1 SHA-2 SHA-3 BLAKE2 SHA-3 finalists BLAKE Grøstl JH Skein Keccak (winner) Other functions CubeHash ECOH FSB GOST HAS-160 HAVAL Kupyna LM hash MD2 MD4 MD6 MDC-2 N-Hash RIPEMD RadioGatún SWIFFT Snefru Streebog Tiger VSH Whirlpool Key derivation functions Argon2 bcrypt crypt Lyra2 PBKDF2 scrypt MAC functions DAA CBC-MAC HMAC NMAC OMAC/CMAC PMAC VMAC UMAC Poly1305 SipHash Authenticated encryption modes CCM CWC EAX GCM IAPM OCB Attacks Collision attack Preimage attack Birthday attack Brute-force attack Rainbow table Side-channel attack Length extension attack Design Avalanche effect Hash collision Merkle–Damgård construction Sponge function HAIFA construction Unique Block Iteration Standardization CRYPTREC NESSIE NIST hash function competition Utilization Hash-based cryptography Key stretching Merkle tree Message authentication Proof of work Salt Pepper v t e Cryptography History of cryptography Cryptanalysis Outline of cryptography Symmetric-key algorithm Block cipher Stream cipher Public-key cryptography Cryptographic hash function Message authentication code Random numbers Steganography Crypto-shredding Category Portal WikiProject Retrieved from "https://en.wikipedia.org/w/index.php?title=SHA-1&oldid=831323719" Categories: Cryptographic hash functionsBroken hash functionsChecksum algorithmsNational Security Agency cryptographyHidden categories: Articles with Chinese-language external linksAll articles with unsourced statementsArticles with unsourced statements from March 2016Articles with unsourced statements from April 2017Articles with specifically marked weasel-worded phrases from March 2017All articles with specifically marked weasel-worded phrasesArticles with specifically marked weasel-worded phrases from September 2015Articles containing potentially dated statements from 2013All articles containing potentially dated statementsArticles with Curlie linksArticles with example pseudocodePages using RFC magic links