<story><title>NIST is announcing that SHA-1 should be phased out by Dec. 31, 2030</title><url>https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm</url></story><parent_chain><item><author>jimrandomh</author><text>SHA-256 is used for Bitcoin mining, which serves as an enormous bug bounty for both full and partial breaks (if you can efficiently find inputs where the output has lots of leading zeroes that&amp;#x27;s a partial break, and lets you mine bitcoin more efficiently). That&amp;#x27;s worth a lot of trust. I don&amp;#x27;t see any particular reason to think SHA-3 is better (though I&amp;#x27;m not an expert) and unless I hear some indication that a problem has been found with SHA-2, I&amp;#x27;ll probably stick with it forever.</text></item></parent_chain><comment><author>pclmulqdq</author><text>Bitcoin mining uses double SHA-256.  It tends to be harder to break doubled hash functions, since you don&amp;#x27;t have tools like length-extension attacks on the second round of hashing.  For example, HMAC-SHA-1 is still secure (despite SHA-1 being pretty much broken), and it also uses a two-round hashing construction.</text></comment>
<story><title>NIST is announcing that SHA-1 should be phased out by Dec. 31, 2030</title><url>https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm</url></story><parent_chain><item><author>jimrandomh</author><text>SHA-256 is used for Bitcoin mining, which serves as an enormous bug bounty for both full and partial breaks (if you can efficiently find inputs where the output has lots of leading zeroes that&amp;#x27;s a partial break, and lets you mine bitcoin more efficiently). That&amp;#x27;s worth a lot of trust. I don&amp;#x27;t see any particular reason to think SHA-3 is better (though I&amp;#x27;m not an expert) and unless I hear some indication that a problem has been found with SHA-2, I&amp;#x27;ll probably stick with it forever.</text></item></parent_chain><comment><author>anderskaseorg</author><text>SHA-256 is vulnerable to a length extension attack.  This is well-known to cryptographers; it doesn’t matter for some applications and can be worked around in others.  But it still catches some developers unaware.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Length_extension_attack&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Length_extension_attack&lt;/a&gt;</text></comment>