Alex Rivera | Logout

How insecure is a salted SHA1 compared to a salted SHA512

Asked 2010-09-18T04:59:01.703
9

SHA1 is completely insecure and should be replaced.

This question is 8+ years old and times have changed: https://arstechnica.com/information-technology/2017/02/at-deaths-door-for-years-widely-used-sha1-function-is-now-dead/

For passwords: https://en.wikipedia.org/wiki/PBKDF2

For data: SHA3

SHA512 is more complex than SHA1, but how much security am I losing by hashing a salted password with SHA1 compared to hashing it with 512? in terms of the time it would take for someone who has the db to crack a single password. I'm using a framework that doesn't give me easy access to SHA512, I'd have to override stuff to make it work, so I'm thinking to just use SHA1, though in the past I've always used SHA512.

php security hash sha1 sha512
Edit
Report

1 Answer

2

If you have to overwrite stuff to get anything other than SHA1 to work, you will have to balance complexity of overriding stuff (and the increased chance of bugs) against algorithm strength.

If you decide to go for another hashing algorithm, you should take a look a BCrypt. It is an adaptable cost hashing algorithm, designed to be 'as slow as needed'. This would provide a bigger increase in required cracking time than SHA512. SHA512 is designed as a general purpose cryptographic hash, with speed as one of the design goals.

There are known vulnerabilities in SHA1, but no preimage attack has yet been found. So if the overriding stuff is difficult, you could be better of by generating high entropy random salts.

Having said that, it is of course better to use the best available algorithm.

answered 2010-09-18T15:42:39.140

Your Answer