Sooo... does this leave the door open for the possibility of SHA1 to be backdoored like this? The FAQ says it's only "unlikely" by assuming NIST didn't have the skills to pull it off?
We believe this is unlikely, for
- Our results rely on state-of-the-art differential cryptanalysis research, as of 2014, based on techniques that were only publicly developed since around 2004"
I'm not a cryptographer but I wonder how they truly can believe that's unlikely since it's entirely possible for the NSA to be 10 years ahead of what was "publicly developed".
Frankly, that's also the most plausible situation independent of what we've learned anyway - it would be fantastically hard to advance technology by ten years entirely in secret. They wouldn't have the benefit of any of the literature released in those 10 years. All their computers and other equipment would be 10 years older, and the sheer number of cryptographers working on these sorts of things at the NSA is almost certainly much smaller than the number working on them outside of these contexts. It would be pretty difficult to pull off, particularly since they can get away with just cheating.
So it's entirely within reason to think the NSA has the potential to be a decade ahead of the public on matters of cryptography.
They eat their own dogfood, too, and move glacially slow: conservativism and military procurement, yay. (One of the Suite A's is basically LUCIFER without the training wheels, a bigger block, and more parity.)
They really aren't as far ahead as you think. What they do have is an absolutely colossal budget, and that helps a lot, especially when they get to cheat, bribe, etc, and try to convince people to use crap stuff that even I could probably break, or stuff on the verge of that (like RC4).
It is similar to what gives Google an advantage. Even if you can write a web crawler that is faster than Google's, it is unlikely that you will be able to crawl the web faster than Google does. That also means your statistical translator likely is worse, your homonym disambiguaties is worse, etc.
There are however known issues with real SHA1 which is why it's not recommended for future development.
http://blogs.technet.com/b/srd/archive/2013/11/12/security-a...