(ISC)2 Certified in Cybersecurity Practice Exam

Is SHA-1 considered a secure hashing algorithm?

1. True

2. False

The correct answer is: False

SHA-1 is considered insecure for cryptographic purposes due to several significant vulnerabilities that have been discovered over time. One of the major weaknesses of SHA-1 is that it is susceptible to collision attacks, where two different inputs can produce the same hash output. This undermines the integrity of the data, as an attacker could potentially create a malicious file that has the same SHA-1 hash as a legitimate file. In 2017, researchers demonstrated practical collision attacks against SHA-1, making it clear that it should no longer be used for securing data or communications. As a result, the cryptographic community has largely moved towards using more secure hashing algorithms, such as SHA-256 or SHA-3, which provide greater resistance against potential attacks. Given these vulnerabilities and the advancements in cryptanalysis, SHA-1 is deemed unsuitable for any application requiring high security, leading to the understanding that it is not a secure hashing algorithm.