Lifetimes of cryptographic hash functions

I think SHA-2 should be "minor weakness discovered" (if not outright "unbroken"), not "weakened". At the onset of the SHA-3 competition, everyone was nervous about SHA-2: it appeared as though a good attack was inevitable, what with the cryptanalytic attacks on SHA-1. But as the competition went on, things got calmer. The attacks against SHA-2 that were so expected simply weren't coming[1]. And so now the status quo is that SHA-2 seems pretty darn safe, and the real focus of…

The SHA-256 "weakness" is a bit disingenuous. As far as I'm aware in the 10 years since that paper was published the "weakness" hasn't been extended _at all_. The main reason for the SHA3 competition was because we were all concerned at the time that SHA2 would be broken and there'd be nothing to replace it with. However as it happens, SHA2 has remained rock solid, so the outcome of SHA3 was to pick something (Keccak) maximally different from SHA2…

This has been discussed before, about 9 months ago: https://news.ycombinator.com/item?id=6123720 And this page was largely written in 2007, although it's been updated a few times since. I'll also note that Val's "Compare by hash considered harmful" is not a conclusion which is widely shared. One can also worry about two people randomly (assuming quality random number generators) choosing the same RSA public key. Or we can worry about all of the oxygen molecules in the room simultaneously randomly deciding to…

Zooko Wilcox privately showed some data at the Decentralized Web Summit suggesting that if you extend these results with newer data, the apparent pattern changes: up until around SHA-1, hash algorithms would eventually break, but since SHA-256, we "figured out how to build them right" and now they can be expected to last "forever." I don't know if his conclusion is right, and unfortunately he hasn't published it, but it at least seems plausible to me. A cryptographic hash function…