Risks to Data Integrity and Authentication Due to SHA-1 Vulnerabilities

In a three-page research note, three Chinese scientists -- Xiaoyun Wang and Hongbo Yu of Shandong University and Yiqun Lisa Yin, a visiting researcher at Princeton University -- stated they have found a way to significantly reduce the time required to break a algorithm, known as the Secure Hashing Algorithm, or SHA-1, widely used for digital fingerprinting data files. Other cryptographers who have seen the document said that the results seemed to be genuine.

An attacker could use the flaw to create two documents or programs that have the same digital fingerprint, also known as a hash; one file could be a legitimate version of the data, while the other could be a forgery. For example, code signing -- where a program is posted online along with its SHA-1 fingerprint as a way to guarantee its integrity -- would essentially be rendered meaningless by this attack.

The link for this article located at Builder AU is no longer available.