Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512?

By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?

share|improve this question
Is SHA-128 a standardized truncation mode for the SHA-2 family? – mikeazo Jun 25 '12 at 18:03
My guess is that SHA-128 should be changed to SHA-1, a 160-bit hash that is in the SHA-2 specification. Oh well I'll do that, rollback if necessary. – fgrieu Jun 25 '12 at 19:41
@fgrieu: I would not call this "in the SHA-2 specification", but "in the Secure Hash Standard (version 2002), which also contains the official specification for SHA-2". – Paŭlo Ebermann Jun 26 '12 at 7:27
@PaŭloEbermann: you are right that the accepted definition of SHA-2 is that it does not encompasses SHA-1, even though SHA-1 is defined in the document specifying the hashes known as SHA-2. – fgrieu Jun 26 '12 at 12:45
up vote 23 down vote accepted

In short, no.

So, what is the current state of cryptanalysis with SHA-1 (for reference only as this question relates to SHA-2) and SHA-2? Bruce Schneier has declared SHA-1 broken. That is because researchers found a way to break full SHA-1 in $2^{69}$ operations. Much less than the $2^{80}$ operations it should take to find a collision due to the birthday paradox.

As far as we know, the best available collision attacks on full round SHA-2 hash functions is still brute force $2^{n/2}$ (where $n$ is the bit length of the output).

share|improve this answer
That's why even after Keccak was selected as the winner of the SHA3 competition, NIST emphasized that it is not meant to replace SHA-2. – Qiu Jul 23 '13 at 9:17

The following table provides a nice "Comparison of SHA functions".

Comparison of SHA functions


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.