SHA-1 collision resistance I'm researching on the SHA-1 algorithm and looking for reasons why it has fallen prey to differential cryptanalysis. I have read the research papers by Merc Stevens and Wang both of which describe how to attack and reduce the complexity of the attack on sha1 but none provide a way to reduce its vulnerability. Please help me out by explaining how to increase the strength of a hash function against differential cryptanalysis.
Probably the biggest vulnerability is that the message expansion is too linear. The linearity of the SHA-1 message expansion is why we are able to find such good differential paths. There can be differences at the beginning of the message and by the end of the message expansion they are mostly canceled out.