Amateurs and pros vie to build new crypto standard

The American National Institute of Standards and Technology has organised a contest to find a new cryptographic hash algorithm to replace SHA-2 (Secure Hash Algorithm - 2).

The Nostradamus hack showed just why people were nervous: Using MD5, researchers were able to create different .pdf files that shared the same hash value. To illustrate why this is a problem, they published the hash value of the pdf file containing the name of their 2008 U.S. presidential election pick, and then created pdfs with the names of every single candidate, all of which shared that same hash.

That's supposed to be virtually impossible to do under a secure hash algorithm.

If the Nostradamus people could use collisions to perform their attack, would criminals eventually be able to create fake digital signatures and make phoney phishing sites look exactly like, for example,

Maybe some day, said Bill Burr, a manager with NIST's Security Technology Group. "SHA-1 is not so broken at the moment that we think that people can do the collisions, but we're expecting the collision any day," he said. "The notion here is that we've got a dike and the dike is leaking, and we're kind of afraid that we could really have a flood."

Even though the latest SHA-2 algorithm "is likely to remain secure for the foreseeable future," it has limitations and is based on old cryptographic techniques, said Schneier, who along with others has submitted a hashing algorithm called Skein. "I think there is good reason to do it."

Picking the new hash algorithm won't be done overnight. NIST's Burr says he doesn't expect to have a SHA-3 winner until 2012, and it may take a decade more for the algorithm to be widely adopted, he said.

But contests like NIST's don't come along everyday, and Burr says he's impressed by the submissions. Many of them, including Rivest's MD6 submission, take advantage of new multi-processor computers that are now commonly available and could be faster than today's algorithms.

"It's just amazing the amount of work that's gone into some of these proposals," Burr said.

"Some of them look fantastic, some of them look like maybe they were done by a 13-year-old kid, and there's everything in between."

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags cryptographySHA-2hashing

More about BillBT AustralasiaMassachusetts Institute of TechnologyMITNielsenWang

Show Comments