, SecurityFocus 2005-08-23
Story continued from Page 1
"The vast majority of calls to a SHA-1 algorithm, only a very small proportion are vulnerable to collision attacks," Burr said.
Common applications that use hash algorithms are somewhat affected by the attacks, but could be modified to be more resistance to any weaknesses in the SHA-1 algorithm, according to Steven Bellovin, computer science professor at Columbia University.
"A collision attack means that it's possible to produce two messages with the same hash value," he said in an e-mail interview with SecurityFocus. "It does not mean that it's possible to produce a message with the same hash value as an existing message. That means that previously-signed documents are not in danger -- yet."
Bellovin co-authored, with security researcher Eric Rescorla, a survey of three popular applications that use hash functions: the secure e-mail protocol, S/MIME; the secure virtual private network protocol, IPSEC; and the TLS security protocol for messaging applications. The researchers found that, while all three are not critically impacted by the cryptographic attacks, the protocols will require modifications to handle an upgrade to a new hash algorithms.
"My concern is that the current protocols are not ready for upgrades, even if we had agreement on new hash functions," Bellovin said in the e-mail interview.
That leaves the cryptographers with a lot to talk about during a rump session, dubbed the Hash Bash, that will be held at the end of October to talk about the issue of SHA-1. While some researchers have advocated holding a competition to pick the next hash algorithm, similar to the run off to decide the Advanced Encryption Standard, other researchers have focused on simpler solutions--for example, adding 40 rounds of additional calculation--and pseudo-randomness--onto the SHA algorithm.
"We, as a community, have a lot of ways to fix this," said Bruce Schneier, chief technology officer for Counterpane Internet Security and a well-known cryptographer.
Schneier recommended that companies wait to see what advice comes out of the conclave of crypto specialists. Until then, developers that have to implement some hash algorithm should look to the strength of SHA-256, he said.
"The sky is not falling, but you can start to see cracks in the ceiling," Schneier added. "If you can wait at all, wait for October when we get together and try answer the questions about the future."