Is it possible to reverse a SHA-1 hash?

by

No, you cannot reverse SHA-1, that is exactly why it is called a Secure Hash Algorithm.

What you should definitely be doing though, is include the message that is being transmitted into the hash calculation. Otherwise a man-in-the-middle could intercept the message, and use the signature (which only contains the sender’s key and the timestamp) to attach it to a fake message (where it would still be valid).

And you should probably be using SHA-256 for new systems now.

sha("My Secret Key"+"a timestamp" + the whole message to be signed)

You also need to additionally transmit the timestamp in the clear, because otherwise you have no way to verify the digest (other than trying a lot of plausible timestamps).

If a brute force attack is feasible depends on the length of your secret key.

The security of your whole system would rely on this shared secret (because both sender and receiver need to know, but no one else). An attacker would try to go after the key (either but brute-force guessing or by trying to get it from your device) rather than trying to break SHA-1.

More Related Contents:

  1. Is it possible to reverse a SHA-1?
  2. RSA signature size?
  3. Difference between Hashing a Password and Encrypting it
  4. In what cases will HTTP_REFERER be empty
  5. XMLHttpRequest cannot load file. Cross origin requests are only supported for HTTP
  6. Why Does OAuth v2 Have Both Access and Refresh Tokens?
  7. Practical non-image based CAPTCHA approaches?
  8. What is the best way to prevent session hijacking?
  9. How to restrict Firebase data modification?
  10. Why is security through obscurity a bad idea? [closed]
  11. Classic ASP SQL Injection Protection
  12. Will HTML Encoding prevent all kinds of XSS attacks?
  13. Password hashing, salt and storage of hashed values
  14. How are software license keys generated?
  15. How to properly do private key management
  16. Symfony2 extending DefaultAuthenticationSuccessHandler
  17. md5 decoding. How they do it?
  18. What is the best Distributed Brute Force countermeasure? [closed]
  19. What is a retpoline and how does it work?
  20. https URL with token parameter : how secure is it?
  21. curl – Is data encrypted when using the –insecure option?
  22. Is it OK to return a HTTP 401 for a non existent resource instead of 404 to prevent information disclosure?
  23. How to pass the value of a variable to the standard input of a command?
  24. Google Authenticator available as a public service?
  25. Securing an API: SSL & HTTP Basic Authentication vs Signature
  26. What’s wrong with XOR encryption?
  27. What is the clash rate for md5? [closed]
  28. Should be used for JSF 2.2 CSRF protection?
  29. is it bad to pass jwt token as part of url?
  30. Setting cookie in iframe – different Domain

Leave a Comment