Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Any estimate on how long SHA 2 will last?


Indefinitely. It's fine. The message expansion in SHA2 is totally different from that of SHA1 (hash message expansion is analogous to cipher key scheduling), and forecloses on the SHA1 attacks. JP Aumasson, part of the BLAKE team, has suggested SHA2 might never be broken; that's hyperbolic but gives a sense of how little research is on the horizon to threaten it.

The big issues with SHA2 are MD structure/length extension (which HMAC addresses, and you can also use the truncated versions; length extension matters pretty much exclusively if you're designing entire new protocols) and speed.

I'd reach for Blake2 right now instead of SHA2 (or SHA3) in a new design, but I wouldn't waste time replacing SHA2 in anything that already exists, or put a lot of effort into adding a dependency to a system that already had SHA2 just to get Blake2.


Then why does NIST warn that we might need PQC algorithms by 2035?

Or is this claim ignoring progress of quantum computing?


Quantum computing threatens factorization and elliptic curves, i.e. RSA and ECDSA. Hash functions are considered relatively safe. The NIST's PQC standardization is focused on public key cryptography—I can't find any initiatives from them working with post-quantum hashing.


Here's one:

"neither us nor our children will see a SHA-256 collision (let alone a SHA-512 collision)" -- JP Aumasson https://twitter.com/veorq/status/652100309599264768


SHA-2 uses the same construction as SHA-1, but my understanding is that there are no practical collision (much less preimage) attacks against full-round SHA-2.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: