• unhash: a program for finding collisions in SHA-1 and MD5
  • ACM Technews on the breaking of SHA-1. I don't believe that SHA-1 is an "encryption" algorithm though - I think it's more of a "cryptographic hash" or "digest" algorithm, which you can think of as a checksum on steroids.
  • I'd like to point out that although fallback-reboot is (largely "was") coded to use SHA-1 for a Challenge-Response authentication system, it's written using the openssl EVP digest functions, so it should be extremely easy to change fallback-reboot to use a different hash algorithm when the time comes.
  • Slashdot article on the breaking of SHA-1
  • SHA-1 broken:
  • Apparently there are more effective versions of SHA in the openssl 0.9.8 development tree, including SHA-256, SHA-384 and SHA-512.
  • Fedora Core 3 appears to include M2Crypto, which includes many python wrappers for openssl/libcrypto functions, including an EVP interface. However, Redhat Enterprise Linux 3 does not appear to. I'm not 100% sure yet, but preliminarily speaking, it looks like Redhat Enterprise Linux 4 won't include M2Crypto. :(
  • The Hash Function Lounge appears to have some pretty good information about hash functions, their designers, and their attacks
  • This page gives some sort of confirmation about what I was suspecting: that ripemd160 might be a suitable alternative to SHA-1. Also, ripemd160 appears to have been in OpenSSL from 0.9.6g and quite possibly earlier.


    Back to Dan's tech tidbits