On the Cost of ASIC Hardware Crackers: A SHA-1 Case Study

Abstract

In February 2017, the SHA-1 hashing algorithm was practically broken using an identical-prefix collision attack implemented on a GPU cluster, and in January 2020 a chosen-prefix collision was first computed with practical implications on various security protocols. These advances opened the door for several research questions, such as the minimal cost to perform these attacks in practice. In particular, one may wonder what is the best technology for software/hardware cryptanalysis of such primitives. In this paper, we address some of these questions by studying the challenges and costs of building an ASIC cluster for performing attacks against a hash function. Our study takes into account different scenarios and includes two cryptanalytic strategies that can be used to find such collisions: a classical generic birthday search, and a state-of-the-art differential attack using neutral bits for SHA-1. We show that for generic attacks, GPU and ASIC poses a serious practical threat to primitives with security level ∼ 64 bits, with rented GPU a good solution for a one-off attack, and ASICs more efficient if the attack has to be run a few times. ASICs also pose a non-negligible security risk for primitives with 80-bit security. For differential attacks, GPUs (purchased or rented) are often a very cost-effective choice, but ASIC provides an alternative for organizations that can afford the initial cost and look for a compact, energy-efficient, reusable solution. In the case of SHA-1, we show that an ASIC cluster costing a few millions would be able to generate chosen-prefix collisions in a day or even in a minute. This extends the attack surface to TLS and SSH, for which the chosen-prefix collision would need to be generated very quickly.

Toward Designing a Secure Authentication Protocol for IoT Environments

“…NIST has standardized three well-known hash functions: SHA-1, SHA-2, and SHA-3. However, SHA-1 is no longer secure due to known attacks [60]. Aside from those hash functions, some hash functions for constrained environments have been developed, such as Quark [61], SPONGNET [62] and PHOTON [63].…”

“…Consider the case when H ID = H PW = 32. The insider adversary is thus required to execute 2 × 2 32 calculations to extract PW X , which can be conducted in seconds on a typical personal computer, but a naive adversary is anticipated to do 2 × 2 64 computations, which is presently not doable even for a mediumsized corporation [60]. As a result, SPP is vulnerable to a privileged opponent who has access to the protocol's registration step.…”