<story><title>NIST is announcing that SHA-1 should be phased out by Dec. 31, 2030</title><url>https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm</url></story><parent_chain><item><author>jimrandomh</author><text>SHA-256 is used for Bitcoin mining, which serves as an enormous bug bounty for both full and partial breaks (if you can efficiently find inputs where the output has lots of leading zeroes that&amp;#x27;s a partial break, and lets you mine bitcoin more efficiently). That&amp;#x27;s worth a lot of trust. I don&amp;#x27;t see any particular reason to think SHA-3 is better (though I&amp;#x27;m not an expert) and unless I hear some indication that a problem has been found with SHA-2, I&amp;#x27;ll probably stick with it forever.</text></item></parent_chain><comment><author>pclmulqdq</author><text>Bitcoin mining uses double SHA-256.  It tends to be harder to break doubled hash functions, since you don&amp;#x27;t have tools like length-extension attacks on the second round of hashing.  For example, HMAC-SHA-1 is still secure (despite SHA-1 being pretty much broken), and it also uses a two-round hashing construction.</text></comment>
<story><title>NIST is announcing that SHA-1 should be phased out by Dec. 31, 2030</title><url>https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm</url></story><parent_chain><item><author>jimrandomh</author><text>SHA-256 is used for Bitcoin mining, which serves as an enormous bug bounty for both full and partial breaks (if you can efficiently find inputs where the output has lots of leading zeroes that&amp;#x27;s a partial break, and lets you mine bitcoin more efficiently). That&amp;#x27;s worth a lot of trust. I don&amp;#x27;t see any particular reason to think SHA-3 is better (though I&amp;#x27;m not an expert) and unless I hear some indication that a problem has been found with SHA-2, I&amp;#x27;ll probably stick with it forever.</text></item></parent_chain><comment><author>mindcandy</author><text>In my research into Ethereum, I learned that in the creation of SHA-3, they did a lot of hammering on SHA-256 to see if new weaknesses could be discovered and addressed.  The conclusion was that SHA-256 is still solid as far as anyone can tell.  The SHA-3 process moved forward anyway so they could have a backup-plan handy in case some problem with SHA-256 pops up out of nowhere.</text></comment>