[ppsp] proposal to remove SHA1 from PPSPP spec

[Dave Cottlehuber <[e-mail]>]

I presume when PPSPP was still called Swift, SHA1 was not yet considered weak. Times have changed, see [1],[2], and speed of e.g. SHA256 is comparable for our requirements [3],[4]. BTW This has been raised already in area review briefly.

The significance of hash weaknesses for a transport protocol are severe - ability for a malicious (*cough* NSA, RIAA *cough*) entity to inject data that ultimately prevents the end user from unzipping or decrypting the transffered content or archive due to corruption by re-using a hash, is a serious weakness.

Given that SHA1 has been considered weak since 2005 (yes, 2005, that’s almost a DECADE ago), are there any reasons for not removing SHA1 entirely from the PPSPP Spec while we still have the chance?

OSX, 2012 iMac:

Doing md5 for 3s on 1024 size blocks: 1249743 md5's in 3.00s
Doing sha1 for 3s on 1024 size blocks: 1258965 sha1's in 3.00s
Doing sha256 for 3s on 1024 size blocks: 527305 sha256's in 2.99s

FreeBSD, CPU: Intel(R) 8 Core i7-4770 CPU @ 3.40GHz (3400.07-MHz K8-class CPU)

openssl speed md5 sha1 sha256 2>&1 |grep 1024                                                                                                                                                                                                                                                           
Doing md5 for 3s on 1024 size blocks: 1683908 md5's in 3.00s
Doing sha1 for 3s on 1024 size blocks: 1797420 sha1's in 3.00s
Doing sha256 for 3s on 1024 size blocks: 749811 sha256's in 3.00s

I tried to find some direct data for mobile devices but failed; [3] has relevant processors though just not specifically produced by a mobile device. Assuming even 2 orders of magnitude worse performance from my aging computers that can do more than 250k hashes in a second, we still can handle hashing far faster than most systems can receive data over the network, and the power usage of hashing is insignificant compared to the most common mobile case of actually displaying the content (video, audio etc).

NB you can compare OpenSSL’s implementation speed on your platform using `openssl speed md5 sha1 sha256 2>&1  | grep 1024`, 

—
Dave Cottlehuber
[e-mail]
[phone]
Sent from the Cloud

[1]: https://www.schneier.com/cgi-bin/mt/mt-search.cgi?search=sha1&__mode=tag
[2]: https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1
[3]: http://bench.cr.yp.to/results-sha3.html
[4]: http://jsperf.com/sha1-performance/9