SHA1 algorithm

[abarbarian]

http://arstechnica.com/security/2015/10/sha1-crypto-algorithm-securing-internet-could-break-by-years-end/

 

SHA1, one of the Internet's most crucial cryptographic algorithms, is so weak to a newly refined attack that it may be broken by real-world hackers in the next three months, an international team of researchers warned Thursday.

SHA1 has long been considered theoretically broken, and all major browsers had already planned to stop accepting SHA1-based signatures starting in January 2017. Now, researchers with Centrum Wiskunde & Informatica in the Netherlands, Inria in France, and Nanyang Technological University in Singapore have released a paper that argues real-world attacks that compromise the algorithm will be possible well before the cut-off date. The results of real-world forgeries could be catastrophic since the researchers estimate SHA1 now underpins more than 28 percent of existing digital certificates.

 

I found this very interesting. If crims only have to spend £70.000 to crack a SHA1 protected asset then crime figures will no doubt rise.

[ebrke]

Oh crap. (Seems I'm saying that frequently.)

[Guest LilBambi]

"Our new GPU-based projections are now more accurate and they are significantly below Schneier’s estimations," the researchers wrote in their paper. "More worrying, they are theoretically already within Schneier’s estimated resources of criminal syndicates as of today, almost two years earlier than previously expected, and one year before SHA-1 being marked as unsafe in modern Internet browsers. Therefore, we believe that migration from SHA-1 to the secure SHA-2 or SHA-3 hash algorithms should be done sooner than previously planned."

 

Makes good sense.

[abarbarian]

Oh crap. (Seems I'm saying that frequently.)

 

Your too ladylike for such language. I recon you see something fishy and think carp but transpose the a and r to innocently make crap.