By now, I am sure you have seen or heard the news about SHA1 being broken.
In a somewhat timely fashion, I had been (re)reading Bruce Schnier and Niels Ferguson's book Practical Cryptography and Bruce Schnier's Applied Cryptography book (both excellent resources) for a couple of weeks for one of my projects before the SHA1 news. Schnier and Keith Brown have both been saying for awhile we should avoid SHA1 and go with SHA256 or SHA512. Now, from what I have heard/read, the government is advocating this as well.
What do we do now? Obviously, there are a lot of solutions already built using SHA1, and since these are one-way hashes, you can't easily "decrypt" a value to get the original value back.
Looking around, I notice a lot of language choices to implement SHA1, but not SHA256 or SHA512. Microsoft .NET offers SHA256 AND SHA512 as options, but what if you are communicating with another applications that doesn't implement these later hash algorithms? One reason MD5 (also broken last summer) and SHA1 were so popular was because they were fast, much faster than the later variations (called SHA-2 implementations). So, no one thought to implement these later versions as SHA1 was thought to be secure enough for awhile.
This past weekend I spent some time going through the algorithm specs to convert a SHA1 algorithm implementation to a SHA256 implementation (in a non-.NET language). It wasn't too difficult, but I imagine this will need to be done more for other languages as we shift away from SHA1 in the near future.
