# Are there any known collisions for the SHA-2 family of hash functions?

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512?

By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?

-
Is SHA-128 a standardized truncation mode for the SHA-2 family? –  mikeazo Jun 25 '12 at 18:03
My guess is that SHA-128 should be changed to SHA-1, a 160-bit hash that is in the SHA-2 specification. Oh well I'll do that, rollback if necessary. –  fgrieu Jun 25 '12 at 19:41
@fgrieu: I would not call this "in the SHA-2 specification", but "in the Secure Hash Standard (version 2002), which also contains the official specification for SHA-2". –  Paŭlo Ebermann Jun 26 '12 at 7:27
@PaŭloEbermann: you are right that the accepted definition of SHA-2 is that it does not encompasses SHA-1, even though SHA-1 is defined in the document specifying the hashes known as SHA-2. –  fgrieu Jun 26 '12 at 12:45

In short, no.

So, what is the current state of cryptanalysis with SHA-1 (for reference only as this question relates to SHA-2) and SHA-2? Bruce Schneier has declared SHA-1 broken. That is because researchers found a way to break full SHA-1 in $2^{69}$ operations. Much less than the $2^{80}$ operations it should take to find a collision due to the birthday paradox.

As far as we know, the best available collision attacks on full round SHA-2 hash functions is still brute force $2^{n/2}$ (where $n$ is the bit length of the output).

-
That's why even after Keccak was selected as the winner of the SHA3 competition, NIST emphasized that it is not meant to replace SHA-2. –  Qiu Jul 23 '13 at 9:17

The following table provides a nice "Comparison of SHA functions".

via https://en.wikipedia.org/wiki/SHA-2#Comparison_of_SHA_functions

-