What is SHA? Everything you need to know about Secure Hash Algorithm

In the modern world, information isn’t secure unless it has been encrypted. This means taking whatever text, graphics or video you have and applying mathematical processes to make it impenetrable to outsiders. Unless they have the key to the maths which locked it up securely. In the world of encryption, hash functions play a key role. These algorithms allow encryption tools to take arbitrary code or text and turn them into fixed, secure chunks of secure data. And in the world of security hashing, none are more important than the SHA family.

You may well have come across SHA when using Virtual Private Networks or trying to secure your business communications. That’s unsurprising, as this hash is the standard encryption method across the web. So if you’re interested in online security, it’s something you need to know about. Let’s dig deeper and find out how the SHA algorithm works, and whether it’s still as safe as it used to be.

A quick introduction to the Secure Hashing Algorithm (SHA)

Firstly, SHA stands for Secure Hashing Algorithm. It’s the last two words which need a bit of unpacking before we can move on to the varieties of Secure Hashing Algorithm, so let’s do just that.

Hashing is a key process in all forms of encryption. Basically, when you start with a message which needs to be encrypted, it has to be passed through a hash function before it is fully encrypted.

Hashes are irreversible processes, and they are generally used as authentication tools. Why? Because when you apply a hash like SHA, it can be compared to source files, ensuring that both match up. When that happens, you can be pretty confident that data hasn’t been tampered with in transit.

Hence, SHA and similar algorithms are often also referred to as “file check” functions. Without them, we wouldn’t know whether the files we are encrypting and transmitting are properly received, and whether they have been damaged or corrupted deliberately.

The “algorithm” section of SHA identified the hash as a mathematical function. That is, it works by applying a set of mathematical rules, ensuring a uniform result. That doesn’t mean people can anticipate the result of the hashing function. It means that people who use the function can be confident that it works every single time.

A brief history of the secure hashing algorithm

Since 1993, SHA has been developed, maintained and distributed by the National Institute for Standards in Technology (NIST). This is a United States government agency which sets many of the global standards which govern how we use the internet. As the history of SHA shows, the institute has been making policy since the WWW was first created.

However, it’s important to know that the SHA algorithm has evolved over its history. In fact, the first version (SHA-0) was removed from circulation almost straight after release when NIST detected weaknesses in its integrity. It was followed by SHA-1, which had a much longer shelf life. SHA-1 was approved by the National Security Agency and became an instrumental part of popular protocols like IPSec and SSL. But even so, as flaws became apparent, the hash was gradually phased out.

By 2010, the NSA was recommending the use of SHA-2. Introduced in 2001, the third SHA incarnation has now been joined by SHA-3, which appeared in 2012. These two versions are most commonly used by government agencies and corporations, although earlier versions continue to be commonly applied – despite security flaws.

What is SHA used for?

SHA-2 and SHA-3 are regularly used by government agencies to ensure that classified information is transmitted without being altered illicitly or corrupted along the way. That’s because hashing allows for almost watertight identification of authentic data – making it tough for people to read data without being detected.

The encryption hash has also been used by companies to protect their intellectual property. For instance, Nintendo employed a version of the SHA algorithm with their Wii consoles, allowing them to ensure that only authenticated downloads could be used by players.

Cryptocurrencies have also embraced SHA algorithms. Bitcoin use the hash to ensure that each transaction on the blockchain can be authenticated – giving holders confidence in the integrity of the currency. In general, any systems using “proof of stake” identifiers will tend to use a variant of SHA.

Understanding the different types of SHA algorithm

As we noted above, the secure hashing algorithm has passed through a number of different versions, and it’s probably useful to run over the differences. The change from SHA-1 to SHA-2 was particularly important from a cyber-security standpoint, so we’ll focus on that in more detail.

• SHA-0 – The first version of the hashing algorithm, SHA-0 was rapidly discontinued, but the project continued despite this initial failure.

• SHA-1 – Developed as part of a US government project named Capstone, SHA-1 technically superseded SHA-0 in 1995. It made only a minor amendment to the actual working of the SHA algorithm, but the NSA assured users that the changes were fundamental, and the new standard became mainstream across the world. However, security experts never developed full confidence in the hash. By 2017 article, Computerworld were describing SHA-1 as “completely unsafe”, and reported that it was possible to create two .pdf files with the same hash signature. Luckily, SHA-1 was on its way out by then.

• SHA-2 – Created in 2001, SHA-2 is a much more complex beast. Since being released, it has also gone through various evolutions, adding variants with 224, 256, 384, 512, 224/512 and 512/256 bit digests (hence many people refer to SHA-2 as a “family” of hashes). Most of the time, SHA-256 and SHA-512 are the option of choice, and are now routinely used with browsers like Chrome or Firefox to authenticate web pages.

• SHA-3 – SHA-2 has been around for a long time now, but the transition from SHA-1 is still not complete. Even so, SHA-3 is now very much on the agenda, having been introduced in 2015. The reason for the development of a next-generation secure hashing algorithm was simple: SHA-2 still hasn’t erased the hashing vulnerabilities detected with SHA-1. SHA-3 claims to be much more secure, faster, and more flexible. However, it has much weaker hardware and software support than SHA-2, which has drastically slowed its adoption. Its time will come, for sure, but for the near future its little brother will be the dominant hashing algorithm. Moreover, NIST haven’t yet recommended making the transition to SHA-3, seeing algorithms like SHA-256 as perfectly sound.

How does the SHA algorithm work?

Before we talk about some of the potential vulnerabilities involved with SHA algorithms, it’s handy to recap what hashes are, and how they work, as all of the versions listed above work along more or less similar lines.

Hashes take messages and convert them into ASCII, then into binary code, before converting this binary code into a hash of the right length (for example 512 bits). This usually involves adding enough zeroes to make up the difference.

Next, the hashing function creates a grid of binary terms, which are “transformed” via rotations and XOR operations. At the end of the series of transformations (which varies depending on which version you are using), you are left with five binary variables.

These variables can then be translated into hexadecimal and combined together into the final hash. You’ve probably seen these codes, which look something like this: 8463d4bf7f1e542d9ca4b544a9713350e53858f0.

The process is theoretically irreversible (and has to be if the hashing function is to work). It’s also data intensive, requiring numerous processing operations. That has led to a constant drive to balance security and efficiency, an area where SHA-3 supposedly scores highly.

Even SHA-1 was once thought to be highly secure. In fact, experts have calculated that “brute force” attackers would require two to the power 159 attempts to carry out an effective attack. That’s a hell of a lot of processing power.

Still, hashing isn’t as secure as you might think. While this basic process has worked well over the years, hashing functions like the SHA algorithm have been targeted by hackers since they were created, and numerous vulnerabilities have been detected.

Are SHA algorithms vulnerable to cyber-attacks?

Despite being embraced by the National Security Agency and NIST, almost all versions of the secure hashing algorithm have been criticized in the past for including potentially fatal weaknesses, and these vulnerabilities are something that users need to be aware of.

In 2005, experts reported a couple of SHA-1 vulnerabilities which effectively signalled that the old standard was becoming obsolete. From 2005-2017, researchers chipped away at the number of operations required to break an SHA-1 hash, making it obvious that the hash was more susceptible to hackers than had been previously thought.

The most famous proof was offered by the SHAttered project, who presented two .pdfs with the same hash. The team still needed to employ vast amounts of processing power (much of it supplied by Google), but the outcome was plain: with rapidly advancing computer speeds, older hashes were acutely vulnerable to brute force and collision attacks.

The same issues discovered with SHA-1 apply to SHA-2, so theoretically web pages, emails, attachments, even videos could have their digital signatures manipulated, making them risky for users to access. Google and Mozilla have recognized this, phasing out SHA-1 and introducing checks to make sure SSL certificates are legitimate. But this doesn’t provide total protection against illegitimate signatures.

Do you need to ensure your security against SHA attacks?

Since the SHA-1 collision revelations emerged in 2017, there has been an ongoing debate about how to protect ordinary web users and websites against the potential for SHA attacks.

As we noted, major browsers have introduced extra checks to protect users against SHA-1 weaknesses, but there are other steps you could take. For instance, using a VPN can help to avoid attack sites – as long as the VPN’s own encryption isn’t affected by SHA issues.

Many VPNs have responded to projects like SHAttered by moving away from SHA-1 and embracing SHA-2 – which is a positive security step, and shows that the VPN is taking the matter seriously. They may also step up their procedures for changing hashes when creating encryption tunnels.

However, some VPN providers are behind the curve when it comes to hashing algorithms, and haven’t taken any action. They often point to the computing power needed to carry out attacks like SHAttered, and the relatively low risk of their encryption being targeted.

This seems to be complacent. We know that processing capacity is rising, and technologies like quantum computing could take it even higher – quite rapidly. Combined with changes in the methods used by hackers, this could leave older algorithms badly exposed, along with VPNs that use them.

So while your data may be safe right now, any VPN users should migrate to services which are aware of SHA-related risks. Look for providers who use SHA-2 as standard and have plans to mainstream SHA-3 when possible. And avoid any services which rely on SHA-1. It’s just not worth the risk any longer.