Lab Notes

Back in February, a Chinese research team reported a practical attack on SHA-1, a significant breakthrough showing weaknesses in the most common internet security protocols (including TLS, the basis for WPA Enterprise security). At this week's Crypto conference, the researchers showed some new improvements in their attack: prior to the February announcement, the best attack was brute force, which took (on average) 2⁸⁰ steps. In February, that was reduced to 2⁶⁹ steps (each time you knock off a power of 2, the attack is twice as easy). Now, they are reporting they can do it in 2⁶⁴ steps — well within the realm of the practical. Expect there to be a lot of work on crypto protocols in the coming months to come up with replacements for SHA-1