Crate sha1dc 

SHA-1 is cryptographically broken, because chosen-prefix collisions against it are practical. However, there are still cases where it is needed for compatibility, such as in git’s object identifiers.

To mitigate this security issue, this crate detects those manufactured collisions. It follows the method of Marc Stevens and Dan Shumow, which finds the message blocks that a collision attack produces and reports them. The paper describes the method, and sha1collisiondetection is the authors’ own implementation, which the tests compare against.

Where available, the implementation uses SHA-1 hardware instructions on x86_64 and aarch64, as well as SIMD-enabled algorithms. Nonetheless, detection does more work per block than plain SHA-1, and costs 14% to 23% of throughput, depending on the machine.

Two modes are provided, as two separate Hasher structs. Hasher keeps the standard digest, with output equivalent to a non-detecting SHA-1 implementation. mitigate::Hasher computes an alternative digest instead. Both report a detected attack as an error.

Example

use sha1dc::Hasher;

let mut hasher = Hasher::new();
hasher.update(b"hello ");
hasher.update(b"world");

match hasher.finalize() {
    Ok(digest) => println!("{digest}"),
    Err(collision) => println!("refusing {}", collision.digest()),
}

Modules

mitigate

Hashing that mitigates a detected collision attack instead of reporting the colliding digest.

Structs

Collision

A collision attack was detected, and not mitigated.

Digest

A SHA-1 digest.

Hasher

SHA-1 hasher that detects a collision attack without changing the digest.

Functions

digest

Hashes data, reporting a detected collision attack.