Six Degrees Group educates public sector in cloud ... » LONDON, U.K: Six Degrees Group (6DG) has announced that it is continuing to educate the public secto... Security Industry Authority renews NSI's mandate t... » The Security Industry Authority (SIA) has renewed the National Security Inspectorate’s (NSI) mandate... Goodluck Jonathan: The limits of goodluck » A quintessential fibre of a discerning leader or anybody who aspires to a leadership position is mas... Dimension data launches strategy to help organis... » The rising cost of energy, real estate, and office space, coupled with growing pressure to implement... New learning materials for updated security qual... » A new range of learning resources has been launched by Highfield.co.uk to help educators and learner... UK: Service of commemoration scheduled for Marc... » The Prime Minister David Cameron announced yesterday in the House of Commons that a Service of Comme... Clavister launches entry-level W20 Firewall » Clavister has announced the launch of its new Clavister W20 firewall appliance. The new product is t... Tinubu Risk Management Center to go live in Janu... » Tinubu Square, the trusted source of credit risk solutions for trade credit insurers and businesses,... BAE Systems awarded £50 million contract » Photo: MoD Photo: MoD The Ministry of Defence (MOD) has awarded a £50m contract to BAE Systems t... Octavian opens new office in South Africa » Octavian Security has kicked off its ambitious 2015 growth plans by launching a new South African of...

CLICK HERE TO

Advertise with Vigilance

Got News?

Got news for Vigilance?

Have you got news/articles for us? We welcome news stories and articles from security experts, intelligence analysts, industry players, security correspondents in the main stream media and our numerous readers across the globe.

READ MORE

Subscribe to Vigilance Weekly

Information Security Header

A new attack makes some password cracking faster, easier than ever. A researcher has devised a method that reduces the time and resources required to crack passwords that are protected by the SHA1 cryptographic algorithm.

Tal Be'ery, Web Researcher at Imperva has looked into the SHA1 methodology and why companies should stay clear of using this method to protect passwords:

 

"First, some context. One of the main use cases for hashing function, such as the SHA-1 function, is to store passwords securely. When attackers obtain such hashed password, they need to launch a “brute force” attack against it, in order to reveal the password. “Brute force” means, they need to repeatedly guess the password, apply the hashing function on it and compare the result with their hash password they have. The security researcher has found an algorithmic shortcut in SHA-1 calculation that makes the computation easier, thus reducing the time needed to successfully “brute force” an attack.

The corollary? In case the hashing is done for security (e.g. hash user passwords, verify data integrity, etc.):

MD5 is dead and should never be used.

SHA-1 is going in the same direction. Consider an upgrade of existing systems and definitely don't use it for new systems.

A smart choice would be to follow the U.S. National Institute of Standards and Technology (NIST) recommendation for federal agencies: "Federal agencies should stop using SHA-1 for generating digital signatures, generating time stamps and for other applications that require collision resistance."

Best option? Use a hash function from SHA-2 family, such as the SHA256."