SHA-1

As explained in Software Security for Developers

SHA-1 is a legacy cryptographic hash algorithm that produces a 160-bit digest and is considered insecure for modern security applications.

SHA-1 is a deterministic cryptographic hash function that produces a fixed-size 160-bit digest for input data. It once served as an industry standard but is now insecure for new security applications. section 4.2.2 section 4.8

Use SHA-1 only when handling historical systems or data. Maven Central retains .sha1 files for backward compatibility, while Git uses SHA-1 to identify files and commits. section 4.2.2 section 4.3

Legacy artifact checks

A Maven Central artifact may have a matching .sha1 file, allowing tools to detect accidental corruption. This does not protect against an attacker who changes both the artifact and its hash. section 4.2.2 section 4.8

Figure 4.5 Files in Maven Central. Notice the .sha1 and .md5 files that contain hash values of the corresponding artifacts. MD5 and SHA-1 are insecure, but Maven Central still uses them for backward compatibility.

Shows legacy .sha1 and .md5 artifact files and their continued use for backward compatibility. section 4.2.2

How Software Security for Developers covers it

How deep it goes

Defines deterministic hashing and practical integrity checking, but defers mathematical internals and active-tampering defenses.

Examples

Uses Maven Central artifact checks, Git commit identifiers, and legacy .sha1 files as concrete examples.

What it assumes

Assumes basic file or commit handling while introducing cryptographic hashing and integrity from practical examples.

What you can do after

Evaluate SHA-1 as legacy compatibility technology and choose SHA-2 or SHA-3 for new applications.

How it connects

Connects SHA-1 with cryptographic hash functions, MD5, SHA-2, SHA-3, Git, HMAC, JCA, and JCE.

liveBookmanning.com

Read Software Security for Developers on liveBook Get the book at manning.com

Related concepts

• Merkle–Damgård constructionimplements · The Merkle–Damgård construction builds an arbitrary-length hash function by iteratively applying a fixed-size compression function to padded message blocks.
• pseudo-random number generatorused by · A pseudorandom number generator is a deterministic computational process that uses an initial seed or internal state to produce a sequence with random-like statistical properties.
• cryptographic hashkind of · A cryptographic hash is a fixed-length digest computed from input data by a deterministic function designed to resist preimage, second-preimage, and collision attacks.

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.