Security Considerations for the SHA-0 and SHA-1 Message-Digest Algorithms

Abstract

This document includes security considerations for the SHA-0 and SHA-1 message digest algorithm. Status of This Memo This document is not an Internet Standards Track specification; it is published for informational purposes. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are a candidate for any level of Internet Standard; see Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6194.

New Collision Attacks on SHA-1 Based on Optimal Joint Local-Collision Analysis

“…Unfortunately, as Polk et al [PCTH11] point out, these cryptanalytic advancements are not reflected in the literature so far, as the improved attacks since the first SHA-1 collision attack are either unpublished or withdrawn.…”

The ARIA Algorithm and Its Use with the Secure Real-Time Transport Protocol (SRTP)

“…All currently registered SRTP crypto suites except the GCM-based ones use HMAC-SHA1 as their HMAC algorithm to provide message authentication. Due to security concerns with SHA-1 [RFC6194], the IETF is gradually moving away from SHA-1 and towards stronger hash algorithms such as SHA-2 or SHA-3 families. For SRTP, however, SHA-1 is only used in the calculation of an HMAC, and no security issue is known for this usage at the time of this publication.…”

Peer-to-Peer Streaming Peer Protocol (PPSPP)

“…As such, it presents a trade-off between performance and security. The security considerations for SHA-1 are discussed in [RFC6194].…”