HashesBroken
Secure Hash Algorithm 1
Cryptographic hash function (deprecated)
How it works
SHA-1 is a Merkle-Damgard hash producing a 160-bit digest. The SHAttered attack (2017) produced the first public collision: two different PDF files with the same SHA-1 hash. Chosen-prefix collisions followed in 2020. NIST disallowed it for digital signature generation and has announced it will be phased out by the end of 2030.
Sizes: 160-bit output
Status: Practical collisions since 2017; NIST plans to phase it out completely by 31 December 2030.
Strengths
- HMAC-SHA1 is not directly broken by collision attacks, because HMAC relies on different properties, so it lingers in some legacy protocols
Weaknesses and known attacks
- SHAttered (2017) and later chosen-prefix collisions make forged signatures and certificates feasible.
- Length extension attacks.
- Browsers and public CAs stopped accepting SHA-1 TLS certificates.
Use it for
- Verifying legacy data where no alternative exists, with a migration plan
Don't use it for
- Digital signatures, certificates, new integrity checks, password hashing
Exam tip
SHA-1 = 160-bit, collision-broken (SHAttered). Replace it with SHA-256 or SHA-3. Git, for example, historically used SHA-1 and has added SHA-256 support.