Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 1 down vote favorite

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512?

By that, I mean are there known values of a and b where F(a) = F(b) and a ≠ b?

share|improve this question
Is SHA-128 a standardized truncation mode for the SHA-2 family? – mikeazo♦ Jun 25 '12 at 18:03
My guess is that SHA-128 should be changed to SHA-1, a 160-bit hash that is in the SHA-2 specification. Oh well I'll do that, rollback if necessary. – fgrieu Jun 25 '12 at 19:41
@fgrieu: I would not call this "in the SHA-2 specification", but "in the Secure Hash Standard (version 2002), which also contains the official specification for SHA-2". – Paŭlo Ebermann♦ Jun 26 '12 at 7:27
1  
@PaŭloEbermann: you are right that the accepted definition of SHA-2 is that it does not encompasses SHA-1, even though SHA-1 is defined in the document specifying the hashes known as SHA-2. – fgrieu Jun 26 '12 at 12:45

1 Answer

up vote 4 down vote accepted

In short, no.

So, what is the current state of cryptanalysis with SHA-1 (for reference only as this question relates to SHA-2) and SHA-2? Bruce Schneier has declared SHA-1 broken. That is because researchers found a way to break full SHA-1 in $2^{69}$ operations. Much less than the $2^{80}$ operations it should take to find a collision due to the birthday paradox.

As far as we know, the best available collision attacks on full round SHA-2 hash functions is still brute force $2^{n/2}$ (where $n$ is the bit length of the output).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.