Photo by Alain Pham on Unsplash

A Few Years To Finally Say Goodbye To SHA-1

If you are into cybersecurity, you should know that the MD5 hashing method should never be used Why? Well, it 128-bit length is just too short, and where it is fairly easy to create a hash collision, and where we can find the same hash for different messages. In fact, it is so bad, that it is possible to inject data into an image, program, or document, and still produce the same hash.

Recently, though, Mat McHugh showed that he could produce the same hash value for different images, using Hashcat, and for just 65 cents on the Amazon GPU Cloud, and which took just 10 hours to process. For this, he created these two images which generate the same hash signature (Figure 1). If we check the hash signatures we get:

C:\openssl>openssl md5 hash01.jpg
MD5(hash01.jpg)= e06723d4961a0a3f950e7786f3766338
C:\openssl>openssl md5 hash02.jpg
MD5(hash02.jpg)= e06723d4961a0a3f950e7786f3766338

Figure 1

With the easy of creating a collision, no company should now be using MD5 [here]. But, now, NIST is officially deprecating the SHA-1 hashing method [here]: