From The ECRYPT Hash Function Website
Revision as of 14:08, 16 October 2006 by Nobbi (talk | contribs) (General)

1 General

2 Cryptanalysis

We can try to give the basic infrmation: so block size general construction of compression functions etc. NO DETAILS. Just reference to the paper proposing the hash function. Then we list the attacks or preliminary analyses. We give the abstract and our opinion about this attack. For instance 2nd-preimages in much less than 2n. Opinion could be: very nice observation, generic, but still not practical since extreme message lengths are required.

I think we should go this way. Esecially we should clearly say what is

  • broken
  • wounded
  •  ?
  • etc.

The SHA-1 compression function
One step of the SHA-1 state update transformation

3 General Description

SHA-1 is an iterated hash function. It can be used to compute a 160-bit hash value for messages having a length of less than 264 bits, cf. FIPS 180-2 Secure Hash Standard. As most iterated hash functions, SHA-1 applies MD strengthening.

3.1 Compression Function

The compression function processes input message blocks of 512 bits and produces a 160-bit chaining value. The compression function of SHA-1 basically consists of two parts: the message expansion and the state update transformation. The chaining variable math (iv in the first iteration) is added to the output of the state update transformation (feed forward).

3.1.1 Message Expansion

In SHA-1, the message expansion is defined as follows. A single 512-bit input message block block is represented by 16 32-bit words, denoted by math, with math. The message input is linearly expanded into 80 32-bit words math defined as follows:


3.1.2 State Update Transformation

The state update transformation starts from a fixed initial value iv for 5 32-bit registers math (also referred to as state variables) and updates these registers in 80 steps (math) by using the word math and the step constant math in step math. One step of the state update transformation is defined as


The function math depends on the step number: steps math use the IF-function referred to as math and steps math use the MAJ-function referred to as math. The remaining steps, use a 3-input XOR referred to as math. The Boolean functions are defined as follows:


3.2 Padding Method

3.3 Constants and Initial Value

3.3.1 Constants


3.3.2 Initial Value


4 Claimed/Expected Security Margins

5 Security Anaylsis

  • Best know attack: 263 by Wang
  • Best known collision example: 64-step collision by De Canniere and Rechberger

something like: best know attack to date: kind of attack, which variant has been looked at (e.g. round-reduced), complexity, and reference to paper and abstract.

may be make here a new page with the other cryptanalysis results.