Slashdot Mirror

← Back to Stories (view on slashdot.org)

SHA-1 Broken

Posted by timothy on from the sha-na-na dept.

Nanolith writes "From Bruce Schneier's weblog: 'SHA-1 has been broken. Not a reduced-round version. Not a simplified version. The real thing. The research team of Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu (mostly from Shandong University in China) have been quietly circulating a paper announcing their results...'" Note, though, that Schneier also writes "The paper isn't generally available yet. At this point I can't tell if the attack is real, but the paper looks good and this is a reputable research team."

14 of 751 comments (clear)

  1. Sigh by Anonymous Coward · · Score: 5, Funny

    And I just got done upgrading from MD5.

    1. Re:Sigh by dasunt · · Score: 4, Funny

      About a month ago, I needed a mechanism for password hashes.

      After some research, I decided that SHA1 was more secure than MD5.

      So I hunted down some good public domain SHA1 code, read through it, and added it to my code.

      Thanks /.!

    2. Re:Sigh by B3ryllium · · Score: 4, Funny

      You do realize, of course, that the recent preponderance of IRC-controlled botnets and such could easily be applied to a computational challenge such as this?

      Imagine tens of thousands of way-overpowered virus-infected 3Ghz Dell machines chewing threw the data?

      Then imagine a beowulf cluster of those.

  2. Prison. by Seumas · · Score: 5, Funny

    A lot of companies and products use SHA1 in some form or another. Does this mean that we can arrest and imprison these "researchers" if they ever step foot in America?

  3. Time to switch.... by Anonymous Coward · · Score: 4, Funny

    ... to SHA-2!

  4. Time to start a panic by psetzer · · Score: 4, Funny

    If you don't switch to the newest, latest hashing algorithm, you will die horribly when your corrupted emacs RPM performs malicious code!!! Everyone, delete everything and log off of the Internets now!!! We're all gonna die!!! HELP!!!

    --
    "Anyone who attempts to generate random numbers by deterministic means is living in a state of sin." -- John von Neumann
  5. Re:Well... by all+your+mwbassguy+a · · Score: 5, Funny

    thank god ROT-13 will never be cracked.

  6. Re:Well... by flatface · · Score: 5, Funny

    That's nothing. ROT-26 offers the best encryption as of yet!

  7. Re:Well... by tonsofpcs · · Score: 5, Funny

    I can't read your post, it seems to be encrypted in that new ROT-26 scheme.

    --
    Video Production Support
  8. better yet-- by bodrell · · Score: 4, Funny

    What someone really ought to do is use ROT-7.5 twice to decrypt ROT-13.

    --
    Si la vida me da palo, yo la voy a soportar Si la vida me da palo, yo la voy a espabilar
    1. Re:better yet-- by isometrick · · Score: 5, Funny

      7.5? 13? I'm guessing you aren't the one who broke SHA-1 ... :-p

    2. Re:better yet-- by SpaceLifeForm · · Score: 4, Funny

      Someone found that ROT-6.5 works better.

      --
      You are being MICROattacked, from various angles, in a SOFT manner.
  9. Hah! by Hobbex · · Score: 4, Funny

    That is nothing. This post has been encrypted with an unbreakable one-time-pad! TWICE!

  10. Well whatever it is... by cmacb · · Score: 4, Funny

    I hope they get it fixed soon.