Hacker News new | past | comments | ask | show | jobs | submit login

Indefinitely. It's fine. The message expansion in SHA2 is totally different from that of SHA1 (hash message expansion is analogous to cipher key scheduling), and forecloses on the SHA1 attacks. JP Aumasson, part of the BLAKE team, has suggested SHA2 might never be broken; that's hyperbolic but gives a sense of how little research is on the horizon to threaten it.

The big issues with SHA2 are MD structure/length extension (which HMAC addresses, and you can also use the truncated versions; length extension matters pretty much exclusively if you're designing entire new protocols) and speed.

I'd reach for Blake2 right now instead of SHA2 (or SHA3) in a new design, but I wouldn't waste time replacing SHA2 in anything that already exists, or put a lot of effort into adding a dependency to a system that already had SHA2 just to get Blake2.




Then why does NIST warn that we might need PQC algorithms by 2035?

Or is this claim ignoring progress of quantum computing?


Quantum computing threatens factorization and elliptic curves, i.e. RSA and ECDSA. Hash functions are considered relatively safe. The NIST's PQC standardization is focused on public key cryptography—I can't find any initiatives from them working with post-quantum hashing.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: