SHA-1 and the Strict Avalanche Criterion

TL;DR

This paper defines the Strict Avalanche Criterion (SAC), proposes an experimental evaluation method, and assesses SHA-1's compliance with SAC, finding it performs well after 24 rounds.

Contribution

It introduces a formal definition of SAC, an evaluation methodology, and applies it to SHA-1 to analyze its confusion and diffusion properties.

Findings

SHA-1 closely tracks SAC after 24 rounds

SHA-1 demonstrates strong confusion and diffusion properties

Results are statistically significant (P < 0.01)

Abstract

The Strict Avalanche Criterion (SAC) is a measure of both confusion and diffusion, which are key properties of a cryptographic hash function. This work provides a working definition of the SAC, describes an experimental methodology that can be used to statistically evaluate whether a cryptographic hash meets the SAC, and uses this to investigate the degree to which compression function of the SHA-1 hash meets the SAC. The results ($P < 0.01$) are heartening: SHA-1 closely tracks the SAC after the first 24 rounds, and demonstrates excellent properties of confusion and diffusion throughout.