<p>SHA-1 was <a href="https://shattered.io/" rel="noreferrer">SHattered</a> by <a href="https://shattered.io/static/shattered.pdf" rel="noreferrer">Stevens et al</a>. They demonstrated that collisions in SHA-1 are practical. They give the first instance of a collision for SHA-1.</p>

<p>It is an <strong>identical-prefix</strong> collision attack that enabled the attacker to forge two distinct PDF documents that have the same SHA-1 hash value. I.e. They extended a given prefix <span class="math-container">$p$</span> with two distinct <strong>near-collision block pairs</strong> for any suffix <span class="math-container">$s$</span> that collides.</p>

<p><span class="math-container">$$\operatorname{SHA-1}(p \mathbin\Vert m_0 \mathbin\Vert m_1 \mathbin\Vert s) = \operatorname{SHA-1}(p \mathbin\Vert m'_0 \mathbin\Vert m'_1 \mathbin\Vert s)$$</span> for any suffix <span class="math-container">$s$</span>, where <span class="math-container">$(m_0, m_1) \neq (m'_0, m'_1)$</span> </p>

<p>The computational requirement is estimated to <span class="math-container">$2^{63.1}$</span></p>

<blockquote>
  <p>The first first-block near collision was found after spending about 3583 core years that had produced 180 711 partial solutions up to step 61. A second near collision block was then later computed; it required an additional 2987 core years and 148 975 partial solutions.<sup><a href="https://shattered.io/static/shattered.pdf" rel="noreferrer">1</a></sup></p>
</blockquote>

CC BY-SA 4.0
2018-10-18T17:03:13.640Z
2018-10-18T17:03:13.640Z
kelalaka
<p>SHA-1 security has been discussed since an algorithm for finding collisions was  first published at CRYPTO 2004 and has been subsequently improved.</p>

<p>Wikipedia lists a couple of <a href="http://en.wikipedia.org/wiki/SHA-1#cite_note-18" rel="noreferrer">references</a>, however it seems the latest research published (and later withdrawn) on this subject was in 2009 (Cameron McDonald, Philip Hawkes and Josef Pieprzyk "Differential Path for SHA-1 with complexity O(2^52)").</p>

<p>Since then, has any significant progress been made on reducing the effort for a hash collision attack on SHA-1?</p>

<p>A link to specific research accompanied with a short summary would be appreciated.</p>

CC BY-SA 3.0
2011-10-02T03:24:54.203Z
You may want to check out [RFC6194](https://tools.ietf.org/html/rfc6194) (March 2011)
netvope
CC BY-SA 3.0
2012-09-12T17:35:52.303Z
I know this is old, but if you are still interested: http://eprint.iacr.org/2012/440
mikeazo
CC BY-SA 3.0
2015-10-26T18:33:48.050Z
I know this is old, but if you are still interested, you may want to take a look at https://sites.google.com/site/itstheshappening/.
Boson
<cr.crypto-security><hash-function><cryptographic-attack>
State of research on SHA-1 Collision Attacks
Johannes Rudolph
# State of research on SHA-1 Collision Attacks

(Asked by: username_0 on 2011-03-07)

SHA-1 security has been discussed since an algorithm for finding collisions was first published at CRYPTO 2004 and has been subsequently improved.

Wikipedia lists a couple of [references](http://en.wikipedia.org/wiki/SHA-1#cite_note-18), however it seems the latest research published (and later withdrawn) on this subject was in 2009 (Cameron McDonald, Philip Hawkes and Josef Pieprzyk "Differential Path for SHA-1 with complexity O(2^52)").

Since then, has any significant progress been made on reducing the effort for a hash collision attack on SHA-1?

A link to specific research accompanied with a short summary would be appreciated.

**Tags:** cr.crypto-security, hash-function, cryptographic-attack
> **Comments:**
> **username_1**: You may want to check out [RFC6194](https://tools.ietf.org/html/rfc6194) (March 2011)  
> **username_2**: I know this is old, but if you are still interested: http://eprint.iacr.org/2012/440  
> **username_3**: I know this is old, but if you are still interested, you may want to take a look at https://sites.google.com/site/itstheshappening/.  

---

## 1 answers

### Answer by username_4 on 2018-10-18. Score: 9 | Accepted answer

SHA-1 was [SHattered](https://shattered.io/) by [Stevens et al](https://shattered.io/static/shattered.pdf). They demonstrated that collisions in SHA-1 are practical. They give the first instance of a collision for SHA-1.

It is an **identical-prefix** collision attack that enabled the attacker to forge two distinct PDF documents that have the same SHA-1 hash value. I.e. They extended a given prefix $p$ with two distinct **near-collision block pairs** for any suffix $s$ that collides.

$$\operatorname{SHA-1}(p \mathbin\Vert m\_0 \mathbin\Vert m\_1 \mathbin\Vert s) = \operatorname{SHA-1}(p \mathbin\Vert m'\_0 \mathbin\Vert m'\_1 \mathbin\Vert s)$$ for any suffix $s$, where $(m\_0, m\_1) \neq (m'\_0, m'\_1)$

The computational requirement is estimated to $2^{63.1}$

> The first first-block near collision was found after spending about 3583 core years that had produced 180 711 partial solutions up to step 61. A second near collision block was then later computed; it required an additional 2987 core years and 148 975 partial solutions.[1](https://shattered.io/static/shattered.pdf)


---

