Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 425
  • Last Modified:

avoiding collisions with SHA1

I wasn't sure which section I should ask this question in, because it isn't a true security question, but it is a question about using the SHA1 algorithm, so I figured that I'd have the best luck in the security section.

I'm using SHA1 as a hash function in my application,  I was wondering if anybody knew what factors to use (or not to use) when giving data to the function to compute the hash for avoiding collisions.   For example is there a range of optimal input lengths that reduce collisions?  Is it bad to use a limited range of input values (ie. only ascii chars).  If anybody has any insight on this it would be very useful.

Thanks,
Nick
0
spikey_nick
Asked:
spikey_nick
  • 2
  • 2
1 Solution
 
chandrasureshCommented:
SHA1, as far as ascii data is considered is very secure and collision free. You can safely use SHA1 in any of your normal applications.
As you would have known, no two strings will produce the same or nearly same hashes even if they both differ by a bit.
0
 
jhanceCommented:
It _is_ possible to have two different plaintexts produce the same hash with SHA or with any other hash but the probability is extremely low.  The best ways to ensure that you don't get a collision is to:

1) Use a strong key.  SHA1 has some weak keys for seeding the hash.  Avoid any of these.
2) Use a long enough hash size.  Obviously, shorter hashes, while faster to generate, are more likely to produce a collision.
0
 
chandrasureshCommented:
SHA1 does not use any key. It just produces  a message digest of the input data given. Also, SHA1 produces a fixed length hash of 20 bytes, whatever is the input length.

jhance, Can you please detail about the key and the hash length which you have specified?
0
 
jhanceCommented:
chandra,

Yes, you are correct.  I was thinking HMAC-SHA1 but this question is about SHA-1.

Regardless, the probability of a collision with 20 bytes of hash is quite low.
0

Featured Post

Cyber Threats to Small Businesses (Part 1)

This past May, Webroot surveyed more than 600 IT decision-makers at medium-sized companies to see how these small businesses perceived new threats facing their organizations.  Read what Webroot CISO, Gary Hayslip, has to say about the survey in part 1 of this 2-part blog series.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now