Schneier on SHA

My ever-favorite security guru Bruce Schneier has been live-blogging a conference he’s been attending on hash functions. There’s some good stuff in all of the posts, but the one that bears reading by anybody technical is the one where he gives the bottom line on the future of SHA-1.

I know Chris and I have talked over this several times. The general idea is SHA-1 is okay for now, but you should start moving away from it.

I find it very interesting that the protocols are so highly-coupled to their algorithms. I’m not sure how true that is. I seem to recall that SSL can have its algorithms swapped out pretty easily, but I guess that doesn’t cover a lot of the other algorithms out there, such as ESP.

It’s also really interesting how little is apparantly understood about hashing functions. We’ve got a good grasp on cryptography, but his comments indicate that hashes are still pretty much a stab-in-the-dark.