# Are there any known collisions for the SHA (1 & 2) family of hash functions?

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512?

By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?

-
meanwhile, a free start collision for sha-1 compress function was found. see here. – Ohad Cohen May 29 at 15:50

In short, no.

So, what is the current state of cryptanalysis with SHA-1 (for reference only as this question relates to SHA-2) and SHA-2? Bruce Schneier has declared SHA-1 broken. That is because researchers found a way to break full SHA-1 in $2^{69}$ operations. Much less than the $2^{80}$ operations it should take to find a collision due to the birthday paradox.

As far as we know, the best available collision attacks on full round SHA-2 hash functions is still brute force $2^{n/2}$ (where $n$ is the bit length of the output).

-
That's why even after Keccak was selected as the winner of the SHA3 competition, NIST emphasized that it is not meant to replace SHA-2. – Qiu Jul 23 '13 at 9:17

The following table should provide a nice comparison of the SHA algorithms and their current status:

[38] The theoretical attack on SHA-1 refers to “Freestart collision for full SHA-1” (PDF) by Marc Stevens and Pierre Karpman and Thomas Peyrin, first published 8 October 2015.

-