Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512?

By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?

share|improve this question
meanwhile, a free start collision for sha-1 compress function was found. see here. – Ohad Cohen May 29 at 15:50
up vote 24 down vote accepted

In short, no.

So, what is the current state of cryptanalysis with SHA-1 (for reference only as this question relates to SHA-2) and SHA-2? Bruce Schneier has declared SHA-1 broken. That is because researchers found a way to break full SHA-1 in $2^{69}$ operations. Much less than the $2^{80}$ operations it should take to find a collision due to the birthday paradox.

As far as we know, the best available collision attacks on full round SHA-2 hash functions is still brute force $2^{n/2}$ (where $n$ is the bit length of the output).

share|improve this answer
That's why even after Keccak was selected as the winner of the SHA3 competition, NIST emphasized that it is not meant to replace SHA-2. – Qiu Jul 23 '13 at 9:17

The following table should provide a nice comparison of the SHA algorithms and their current status:

Comparison of SHA functions

[38] The theoretical attack on SHA-1 refers to “Freestart collision for full SHA-1” (PDF) by Marc Stevens and Pierre Karpman and Thomas Peyrin, first published 8 October 2015.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.