On the Cost of ASIC Hardware Crackers: A SHA-1 Case Study - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2021

On the Cost of ASIC Hardware Crackers: A SHA-1 Case Study


In February 2017, the SHA-1 hashing algorithm was practically broken using an identical-prefix collision attack implemented on a GPU cluster, and in January 2020 a chosen-prefix collision was first computed with practical implications on various security protocols. These advances opened the door for several research questions, such as the minimal cost to perform these attacks in practice. In particular, one may wonder what is the best technology for software/hardware cryptanalysis of such primitives. In this paper, we address some of these questions by studying the challenges and costs of building an ASIC cluster for performing attacks against a hash function. Our study takes into account different scenarios and includes two cryptanalytic strategies that can be used to find such collisions: a classical generic birthday search, and a state-of-the-art differential attack using neutral bits for SHA-1. We show that for generic attacks, GPU and ASIC poses a serious practical threat to primitives with security level ∼ 64 bits, with rented GPU a good solution for a one-off attack, and ASICs more efficient if the attack has to be run a few times. ASICs also pose a non-negligible security risk for primitives with 80-bit security. For differential attacks, GPUs (purchased or rented) are often a very cost-effective choice, but ASIC provides an alternative for organizations that can afford the initial cost and look for a compact, energy-efficient, reusable solution. In the case of SHA-1, we show that an ASIC cluster costing a few millions would be able to generate chosen-prefix collisions in a day or even in a minute. This extends the attack surface to TLS and SSH, for which the chosen-prefix collision would need to be generated very quickly.
Fichier principal
Vignette du fichier
article.pdf (5.42 Mo) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-03529193 , version 1 (17-01-2022)



Anupam Chattopadhyay, Mustafa Khairallah, Gaëtan Leurent, Zakaria Najm, Thomas Peyrin, et al.. On the Cost of ASIC Hardware Crackers: A SHA-1 Case Study. CT-RSA 2021 - The Cryptographer’s Track at the RSA Conference, May 2021, Virtual, United States. pp.657-681, ⟨10.1007/978-3-030-75539-3_27⟩. ⟨hal-03529193⟩


70 View
172 Download



Gmail Mastodon Facebook X LinkedIn More