Solved

avoiding collisions with SHA1

Posted on 2006-07-05
4
415 Views
Last Modified: 2010-04-11
I wasn't sure which section I should ask this question in, because it isn't a true security question, but it is a question about using the SHA1 algorithm, so I figured that I'd have the best luck in the security section.

I'm using SHA1 as a hash function in my application,  I was wondering if anybody knew what factors to use (or not to use) when giving data to the function to compute the hash for avoiding collisions.   For example is there a range of optimal input lengths that reduce collisions?  Is it bad to use a limited range of input values (ie. only ascii chars).  If anybody has any insight on this it would be very useful.

Thanks,
Nick
0
Comment
Question by:spikey_nick
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 2

Accepted Solution

by:
chandrasuresh earned 250 total points
ID: 17049599
SHA1, as far as ascii data is considered is very secure and collision free. You can safely use SHA1 in any of your normal applications.
As you would have known, no two strings will produce the same or nearly same hashes even if they both differ by a bit.
0
 
LVL 32

Expert Comment

by:jhance
ID: 17049882
It _is_ possible to have two different plaintexts produce the same hash with SHA or with any other hash but the probability is extremely low.  The best ways to ensure that you don't get a collision is to:

1) Use a strong key.  SHA1 has some weak keys for seeding the hash.  Avoid any of these.
2) Use a long enough hash size.  Obviously, shorter hashes, while faster to generate, are more likely to produce a collision.
0
 
LVL 2

Expert Comment

by:chandrasuresh
ID: 17050150
SHA1 does not use any key. It just produces  a message digest of the input data given. Also, SHA1 produces a fixed length hash of 20 bytes, whatever is the input length.

jhance, Can you please detail about the key and the hash length which you have specified?
0
 
LVL 32

Expert Comment

by:jhance
ID: 17054818
chandra,

Yes, you are correct.  I was thinking HMAC-SHA1 but this question is about SHA-1.

Regardless, the probability of a collision with 20 bytes of hash is quite low.
0

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, Microsoft released a best-practice guide for securing Active Directory. It's a whopping 300+ pages long. Those of us tasked with securing our company’s databases and systems would, ideally, have time to devote to learning the ins and outs…
Liquid Web and Plesk discuss how to simplify server management with a single tool  in their webinar.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
Suggested Courses

729 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question