Is SHA1 still secure for use as hash function in PBKDF2?

cryptography hash sha1 pbkdf2
Christian Aichinger picture Christian Aichinger · Feb 8, 2011 · Viewed 8.6k times · Source

As there have been significant advances in the cryptoanalysis of SHA1 it's supposed to be phased out in favor of SHA2 (wikipedia).

For use as underlying hash function in PBKDF2, however, it's basically used as a PRNG. As such it should be still secure to use SHA1 as hash for PBKDF2, right?

Answer

Thomas Pornin picture Thomas Pornin · Feb 9, 2011

None of the currently known weaknesses on SHA-1 has any impact on its security when used in HMAC, a fortiori when used in PBKDF2. For that matter, MD5 would be fine too (but not MD4).

However, SHA-1 is not good for public relations: if, in 2011, you use SHA-1, then you must prepare yourself to have to justify that choice. On the other hand, SHA-256 is a fine "default function" and nobody will question it.

There is no performance issue in PBKDF2 (PBKDF2 includes an "iteration count" meant to make it exactly as slow as needed) so there is very little reason to prefer SHA-1 over SHA-256 here. However, if you have an existing, deployed system which uses PBKDF2-with-SHA-1, then there is no immediate need to "fix" it.

Related questions

Is calculating an MD5 hash less CPU intensive than SHA family functions?

Is calculating an MD5 hash less CPU intensive than SHA-1 or SHA-2 on "standard" laptop x86 hardware? I'm interested in general information, not specific to a certain chip. UPDATE: In my case, I'm interested in calculating the hash of a …

Read More
Is SHA-1 secure for password storage?

Conclusion: SHA-1 is as safe as anything against preimage attacks, however it is easy to compute, which means it is easier to mount a bruteforce or dictionary attack. (The same is true for successors like SHA-256.) Depending on the circumstances, …

Read More
Is it possible to get identical SHA1 hash?

Given two different strings S1 and S2 (S1 != S2) is it possible that: SHA1(S1) == SHA1(S2) is True? If yes - with what probability? If not - why not? Is there a upper bound on the length of a …

Read More