Proving knowledge of a preimage of a hash without disclosing it? We consider a public hash function $H$, assumed collision-resistant and preimage-resistant (for both first and second preimage), similar in construction to SHA-1 or SHA-256.
Alice discloses a value $h$, claiming that she (or/and parties she can communicate with or/and devices they have access to) knows a message $m$ such that $H(m)=h$. Can some protocol convince Bob of this claim without help of a third party/device that Bob trusts, nor allowing Bob to find $m$?
At Crypto 98 rump session, Hal Finney made a 7-minutes presentation A zero-knowledge proof of possession of a pre-image of a SHA-1 hash which seems to be intended for that. This remarkable result is occasionally stated as fact, including recently here and next door. But I do not get how it is supposed to work.
Update: This talk mentions using the protocol in the Crypto'98 paper of Ronald Cramer and
Ivan B. Damgård: Zero-Knowledge Proofs for Finite Field Arithmetic or: Can Zero-Knowledge be for Free? (this version is very similar, or there is this earlier, longer version).
I'm not sure what I can add that wasn't covered in the talk. The approach is that Alice commits to the preimage and sends the commitment to Bob. The commitment has homomorphic properties, meaning it is possible to do computation on the value. 

For example, if Alice commits to $x$ and $y$, Bob may be able to compute a commitment to $z$ where $z=f(x,y)$ for some function $f$. For example, if the commitments are additively homomorphic, Bob can add two commitments or multiply by a constant for free.

Alternatively, $f$ may not be directly computable. In this case, Alice who knows the actual values computes $z$, sends a commitment to $z$ to Bob asserting that it is correct. Bob holds commitments to $x$, $y$, and $z$; as well as knowing $f$. Alice can then interactively prove that for $f$, the commitment containing $z$ does contain the correct output for the inputs contained in the commitments to $x$ and $y$.

The Cramer-Damgaard paper shows how to do these proofs for a simple Turning-complete set of both boolean and arithmetic gates (for example, NAND and modular addition/multiplication). 

The size of the circuit implementing SHA-1, expressed with only NAND gates for example, will be very large and infeasible. The art to doing the proof in practice is breaking it into subprotocols that are best represented by either boolean or arithmetic circuits and switching between the proof systems as appropriate. For certain SHA operations, he works at the bit level with boolean operations and for other operations, he works with integers in a finite field.