Skip to main content
Cipher Visualizers Logo
Hash Functions Beginner

Understanding the SHA-1 Algorithm

Secure Hash Algorithm 1 was for years one of the most widely used cryptographic hash functions.

PL
Pashalis Laoutaris
July 18, 2025
8 min read
#Hashing #SHA-1 #Cryptography #Hash Function

Interactive SHA-1 Hash Visualizer

🔐 SHA1 Hash Visualizer

5
Enter text and click a button to start!

SHA-1 (Secure Hash Algorithm 1) was for years one of the most widely used cryptographic hash functions for securing digital information. Like MD5, its reputation for security has been eroded by advances in cryptanalysis. This article covers SHA-1’s history, how it works, its pros and cons, why it’s obsolete, recent news, and reliable references.

Table of Contents

  1. History of SHA-1
  2. How SHA-1 Works: A Detailed Guide
  3. Python Implementation
  4. Limitations
  5. Pros and Cons of SHA-1
  6. Why SHA-1 is Broken
  7. Latest News about SHA-1
  8. FAQ
  9. References

History of SHA-1

SHA-1 was developed by the United States National Security Agency (NSA). The National Institute of Standards and Technology (NIST) published it in 1995 as a federal standard. It was designed to be a secure successor to SHA-0, which had an undisclosed flaw.

SHA-1 quickly gained enormous popularity. It became the default hash function for SSL/TLS certificates, software updates, digital signatures, and version control systems like Git. But cryptanalysts began to expose vulnerabilities. By the 2010s, SHA-1 was being phased out in favor of stronger hash functions.

How SHA-1 Works: A Detailed Guide

SHA-1 processes data to produce a 160-bit (20-byte) hash value, usually rendered as a 40-character hexadecimal string.

1. Padding

  • The message is padded so its length (in bits) is congruent to 448 mod 512 (i.e., length = 512n + 448).
  • Padding starts with a single 1 bit, then enough 0s are added to reach the required length.

2. Appending Length

  • The original length of the message (in bits) is appended as a 64-bit big-endian integer.

3. Initialization

  • Five 32-bit variables are initialized with specific constants:
    • h0 = 0x67452301
    • h1 = 0xEFCDAB89
    • h2 = 0x98BADCFE
    • h3 = 0x10325476
    • h4 = 0xC3D2E1F0

4. Processing Message in 512-bit Blocks

  • Each block is divided into 16 words (32 bits each), then expanded into 80 words using bitwise operations.
  • For each of 80 rounds per block, a series of logical functions (including AND, OR, XOR, NOT) and modular additions are applied.
  • The five state variables are updated in each round.

5. Output

  • After all blocks are processed, the hash value is the concatenation of h0, h1, h2, h3, and h4 (totaling 160 bits).
  • Final output is typically shown as a 40-character hexadecimal value.

Example in Pseudocode

for each 512-bit block: expand block into 80 32-bit words initialize variables a, b, c, d, e with h0-h4 for i = 0 to 79: perform round-specific operations and logical functions update h0-h4 output: h0 || h1 || h2 || h3 || h4

Python Implementation

The message schedule expansion and the four round functions described above translate directly into a working implementation:

def left_rotate(x, c):
    return ((x << c) | (x >> (32 - c))) & 0xFFFFFFFF

def sha1(message: bytes) -> bytes:
    h0, h1, h2, h3, h4 = 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0

    msg = bytearray(message)
    orig_len_bits = (len(message) * 8) & 0xFFFFFFFFFFFFFFFF
    msg.append(0x80)
    while len(msg) % 64 != 56:
        msg.append(0)
    msg += orig_len_bits.to_bytes(8, 'big')

    for offset in range(0, len(msg), 64):
        chunk = msg[offset:offset + 64]
        w = [int.from_bytes(chunk[i:i+4], 'big') for i in range(0, 64, 4)]
        for i in range(16, 80):
            w.append(left_rotate(w[i-3] ^ w[i-8] ^ w[i-14] ^ w[i-16], 1))

        a, b, c, d, e = h0, h1, h2, h3, h4
        for i in range(80):
            if i < 20:
                f = (b & c) | (~b & d); k = 0x5A827999
            elif i < 40:
                f = b ^ c ^ d; k = 0x6ED9EBA1
            elif i < 60:
                f = (b & c) | (b & d) | (c & d); k = 0x8F1BBCDC
            else:
                f = b ^ c ^ d; k = 0xCA62C1D6

            temp = (left_rotate(a, 5) + f + e + k + w[i]) & 0xFFFFFFFF
            e, d, c, b, a = d, c, left_rotate(b, 30), a, temp

        h0 = (h0 + a) & 0xFFFFFFFF
        h1 = (h1 + b) & 0xFFFFFFFF
        h2 = (h2 + c) & 0xFFFFFFFF
        h3 = (h3 + d) & 0xFFFFFFFF
        h4 = (h4 + e) & 0xFFFFFFFF

    return b''.join(v.to_bytes(4, 'big') for v in (h0, h1, h2, h3, h4))

if __name__ == "__main__":
    print(sha1(b"abc").hex())

Running this on b"abc" produces a9993e364706816aba3e25717850c26c9cd0d89d, matching the standard published SHA-1 test vector for that input. I checked this implementation against Python’s own hashlib.sha1 on several inputs, including the empty string, before writing this up.

Limitations

This is a genuine, complete implementation of the real (broken) algorithm, not a simplified stand-in:

  • No streaming interface. This function takes the entire message as one bytes object; hashlib’s incremental .update() interface handles very large inputs or data arriving in chunks more practically.
  • Not hardened against timing side-channels. This is a direct translation of the specification for readability, not an implementation optimized or audited for constant-time behavior.
  • Reproduces SHA-1’s brokenness faithfully, by design. This code doesn’t patch over the collision vulnerabilities the SHAttered attack exploited; it exists to show exactly which arithmetic those attacks target, not to offer a “safer” SHA-1.
  • Never use this, or any SHA-1 implementation, for security-critical purposes. As the Why SHA-1 is Broken section below documents, that holds regardless of implementation quality.

Pros and Cons of SHA-1

Pros Cons
More secure than MD5 (historically) Vulnerable to collision attacks
Widespread historical adoption No longer considered secure for cryptography
Simple and efficient implementation Susceptible to chosen-prefix collisions
Good performance on most platforms Phased out by major organizations and browsers

Why SHA-1 is Broken

SHA-1 was designed to be collision-resistant, but cryptanalysis has shown this is no longer the case. In February 2017, Google and CWI Amsterdam publicly demonstrated the first practical SHA-1 collision, known as the SHAttered attack. This proved that attackers can create two different documents with the same SHA-1 hash. That undermines trust in digital signatures, certificates, and file integrity mechanisms.

Key Weaknesses

  • Collision Attacks: It is now feasible (using cloud computing) for attackers to generate two different inputs with the same SHA-1 hash.
  • Cost of Attack Drops: As of 2024, the cost to generate a SHA-1 collision is under $50,000, well within the reach of motivated attackers.
  • Chosen-prefix Collisions: In 2019, researchers demonstrated more dangerous “chosen-prefix” collisions. These let attackers create two arbitrary files with matching SHA-1 hashes.
  • Deprecation: Browsers, certificate authorities, and security standards organizations have deprecated SHA-1 for all security-critical purposes.

Summary: SHA-1 should not be used for cryptographic security. SHA-2 and SHA-3 are the current recommended standards.

Latest News about SHA-1

  • 2024: Almost all major browsers, TLS libraries, and certificate authorities have completely disabled support for SHA-1 certificates.
  • Git and Code Repositories: Git originally relied on SHA-1. It has since implemented SHA-256 support and recommends migrating repositories.
  • Cryptanalysis: Researchers continue to improve collision-finding techniques. In 2023, they set new records for SHA-1 collision computation.
  • Industry Guidance: NIST, Microsoft, Google, and Mozilla have all issued strong warnings, or outright bans, on using SHA-1 in any security context.

Bottom Line: SHA-1 is obsolete and insecure for any use beyond non-critical checksums.

FAQ

What is SHA-1 and what does it do?

SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function that produces a 160-bit hash value from arbitrary input data. It was used for digital signatures, file integrity checks, and SSL/TLS certificates but is now considered insecure.

Why is SHA-1 no longer considered secure?

SHA-1 is insecure because of practical collision attacks, like the 2017 SHAttered attack. It showed that two different inputs can produce the same hash. Chosen-prefix collisions (2019) further compromised its reliability for cryptographic purposes.

What are the main vulnerabilities of SHA-1?

SHA-1 is vulnerable to collision attacks (creating two inputs with the same hash) and chosen-prefix collisions (crafting arbitrary files with matching hashes). These weaknesses make it unsuitable for digital signatures, certificates, or password hashing.

Can SHA-1 still be used for any purposes?

SHA-1 can be used for non-cryptographic purposes, such as non-security-critical checksums or legacy system compatibility (e.g., Git). But it should not be used for any security-sensitive applications, because of its vulnerabilities.

Recommended alternatives include SHA-256 or SHA-512 (from the SHA-2 family) and SHA-3 for cryptographic purposes. These algorithms offer stronger collision resistance and are widely supported in modern systems.

How does SHA-1 compare to MD5?

SHA-1 is historically more secure than MD5, with a longer 160-bit output compared to MD5’s 128-bit output. But both are now cryptographically broken due to collision vulnerabilities. SHA-1 is slightly more resistant, but still obsolete.

Why is SHA-1 still relevant for educational purposes?

SHA-1’s historical significance, widespread past use, and well-documented vulnerabilities make it a valuable case study. It’s great for learning about cryptographic hash functions, collision attacks, and why stronger algorithms like SHA-2 or SHA-3 matter.

References

Note: For new applications, use SHA-2 (e.g., SHA-256, SHA-512) or SHA-3.