1

Assume I create a hash using SHA-256 and then take only the first 160 bits of the hash, as the result. is the result more cryptographically secured than SHA-1? Or are the two algorithms equally secure except for the hash size? (for example in terms of uneven distribution of the hashes and other means that determined the resilience of hashing algorithms)

What about the rest of the SHA family of hashing algorithms such as SHA-512?

Aviv Aviv
  • 113
  • 3

1 Answers1

5

Yes, SHA-256 is safer than SHA-1 beyond the hash size.

In particular, SHA-256 truncated to 160 bits is significantly more collision resistant than SHA-1 is: we can make a collision for SHA-1 with effort like $2^{61.2}$ hashes, versus more than $2^{80}$ for an unbroken hash, including SHA-256.

When it's known that all targeted platforms are 64-bit, SHA-512 (and truncated versions) is often preferred to SHA-256, because it's faster for large input. It's probably also rather safer (but safer than safe is rather pointless).

SHA-3 and SHAKE have the further advantages of not having the length-extension property (contrary to non-truncated SHA-1, SHA-256, SHA-512), and (for SHAKE) of having customizable output length.


As far as I understand, the hash is used as a password generator, I imagine from a master secret, a site name, and a login. In theory, we'd need a MAC with the master secret as key, and the rest as the other input; or a hash designed to be a MAC simply by starting the hashed message with the key. SHA-3 is superior in that regard. If we use SHA-1 or SHA-256 we should use HMAC-SHA-1 or HMAC-SHA-256; but OTOH there is no known attack if we do not.

fgrieu
  • 149,326
  • 13
  • 324
  • 622