Re: [EXTERNAL] Openssl 3.5 FIPS and SHA-1

Yes, SHA-1 is and should be in the FIPS provider for now.

Tomas Mraz, Chief Technology Officer, OpenSSL Foundation


On Tue, 2026-01-20 at 16:32 -0500, Ken Goldman wrote:
> Is the answer, then, that SHA-1 is expected to be in the fips
> provider?
> 
> On 1/20/2026 3:13 AM, 'Martin Bonner' via openssl-users wrote:
> > Yes.  See https://csrc.nist.gov/projects/cryptographic-module- 
> > validation-program/sp-800-140-series-supplemental-
> > information/sp800-140c 
> > <
> > https://csrc.nist.gov/projects/cryptographic-module-validation-progr
> > am/ 
> > sp-800-140-series-supplemental-information/sp800-140c> .
> > 
> > SHA-1 is still approved for situations where security requires pre-
> > image 
> > resistance (given a fixed message M, it is hard to find another
> > message 
> > M1 such that Hash(M1) == Hash(M). An alternative, slightly weaker 
> > formulation, is given a fixed value V, it is hard to find a message
> > M1 
> > such that Hash(M1) == V).
> > 
> > The problem with SHA-1 is that it is not collision resistant (it is
> > known how to find two values M1, M2 such that Hash(M1) ==
> > Hash(M2)).  
> > Note that the difference with collision resistance, is that the
> > attacker 
> > gets to choose /both/ messages.  Collision resistance is the
> > property 
> > you want for a hash which is used to digest a message before
> > signing.
> > 
> > Collision resistance implies pre-image resistance, and when
> > building a 
> > protocol the safe rule of thumb is to use an algorithm which is 
> > collision resistant (SHA-2/SHA-3) just in case collision resistance
> > is 
> > the property you need.  However if you have an existing protocol, 
> > careful analysis may show it is still currently secure
> > 
> > Martin Bonner
> > 
> > *From:*[email protected] <openssl- 
> > [email protected]> *On Behalf Of *Ken Goldman
> > *Sent:* 19 January 2026 23:52
> > *To:* [email protected]
> > *Subject:* [EXTERNAL] Openssl 3.5 FIPS and SHA-1
> > 
> > Looking at
> > https: //urldefense. com/v3/__https: //docs. openssl. org/3.  
> > 5/man7/OSSL_PROVIDER-FIPS/*approved-algorithms__;Iw!!FJ-Y8qCqXTj2! 
> > dEDWcfZHH1HIbrmQ8PLFovSXwvQSkAlk3hMHhPo1uGlLk2xfVJPMBlD3_mbHF8p_EDD
> > Zd3OZ5IaHJbdq0-Qg$ I see SHA-1 on the list. 
> > 
> > Looking at
> > 
> > https://urldefense.com/v3/__https://docs.openssl.org/3.5/man7/ 
> > OSSL_PROVIDER-FIPS/*approved-algorithms__;Iw!!FJ-Y8qCqXTj2! 
> > dEDWcfZHH1HIbrmQ8PLFovSXwvQSkAlk3hMHhPo1uGlLk2xfVJPMBlD3_mbHF8p_EDD
> > Zd3OZ5IaHJbdq0-Qg$
> > <https://urldefense.com/v3/__https:/docs.openssl.org/3.5/man7/OSSL_
> > PROVIDER-FIPS/*approved-algorithms__;Iw!!FJ-
> > Y8qCqXTj2!dEDWcfZHH1HIbrmQ8PLFovSXwvQSkAlk3hMHhPo1uGlLk2xfVJPMBlD3_
> > mbHF8p_EDDZd3OZ5IaHJbdq0-Qg$>
> > 
> > I see SHA-1 on the list. Is SHA-1 really approved?
> > 
> > -- 
> 

-- 
Tomáš Mráz, Chief Technology Officer, OpenSSL Foundation
Join the Code Protectors or support us on Github Sponsors
https://openssl-foundation.org/donate/


-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/8dbcf340c94b5f4ac6cf037a54876e811a4e0f05.camel%40openssl.org.