SHA1 is now broken, should FB 2.0 still use it?

Bug Submitted By: Simon McKenna (hypersi)
Summary: SHA1 is now broken, should FB 2.0 use it?

Initial Comment:
>From README.sha1.txt:

"New hashing algorithm, selected for firebird 2.0, is
SHA-1"

However, some clever Chinese researchers have made
brute force attack on SHA-1 far more attractive:

http://www.schneier.com/crypto-gram-0503.html#1

I'm sure you fine folks already know this, but a
headsup just in case  :) 

peace
si


----------------------------------------------------------------------

>Comment By: Sean Leyne (seanleyne)

Date: 2005-04-04 12:36

While the SHA-1 algorithm has been cracked, and a
algorithm is now available to make the attack more possible.

The most important aspect of the article is:

"...On the software side, the main comparable is a 264
keysearch done by distributed.net that finished in 2002. One
article put it this way: "Over the course of the competition,
some 331,252 users participated by allowing their unused
processor cycles to be used for key discovery. After 1,757
days (4.81 years), a participant in Japan discovered the
winning key." Moore's Law means that today the calculation
would have taken one quarter the time -- or have required one
quarter the number of computers -- so today a 269
computation would take eight times as long, or require eight
times the computers."

This means that it would take **32 years or 2.4 million
computers** to find a matching SHA-1 hash!

Further the article continues:

"For the average Internet user, this news is not a cause for
panic. No one is going to be breaking digital signatures or
reading encrypted messages anytime soon. The electronic
world is no less secure after these announcements than it
was before."

Accordingly, there is nothing in the article which will affect
Firebird security and its use of SHA-1 for the foresable future.

Finally, there has already been much discussion of a new
feature to enable a plug-in security architecture which would
allow for users to implement their own security
tools/algorithms (SHA-224, SHA-256, SHA-384, or SHA-
512).  The implementation of the new security approach is
being discussed as a v3.0 feature.