Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512?
By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?
$\begingroup$
$\endgroup$
4
-
$\begingroup$ meanwhile, a free start collision for sha-1 compress function was found. see here. $\endgroup$– Ohad CohenCommented May 29, 2016 at 15:50
-
1$\begingroup$ There is now a published collision for SHA1 at shattered.it $\endgroup$– David LCommented Feb 23, 2017 at 15:48
-
$\begingroup$ Possible duplicate of What is the new attack on SHA-1 "SHAttered" and how does it work? $\endgroup$– kenorbCommented Feb 26, 2017 at 16:11
-
$\begingroup$ @kenorb that answers only a part of this question. $\endgroup$– otusCommented Feb 26, 2017 at 19:54
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
2
This answer is now out of date as on Feb 23 2017, a collision for SHA-1 was found. See What is the new attack on SHA-1 “SHAttered” and how does it work?
In short, no.
So, what is the current state of cryptanalysis with SHA-1 (for reference only as this question relates to SHA-2) and SHA-2? Bruce Schneier has declared SHA-1 broken. That is because researchers found a way to break full SHA-1 in $2^{69}$ operations. Much less than the $2^{80}$ operations it should take to find a collision due to the birthday paradox.
As far as we know, the best available collision attacks on full round SHA-2 hash functions is still brute force $2^{n/2}$ (where $n$ is the bit length of the output).
-
$\begingroup$ That's why even after Keccak was selected as the winner of the SHA3 competition, NIST emphasized that it is not meant to replace SHA-2. $\endgroup$– QiuCommented Jul 23, 2013 at 9:17
-
$\begingroup$ This answer is now out of date, because a SHA-1 collision has been published. $\endgroup$ Commented Feb 23, 2017 at 22:46
$\begingroup$
$\endgroup$
0
First up, the following table should provide a nice comparison of the SHA algorithms and their status back in 2013, when I fist posted this answer:
[38] The theoretical attack on SHA-1 refers to “Freestart collision for full SHA-1” (PDF) by Marc Stevens and Pierre Karpman and Thomas Peyrin, first published 8 October 2015.
Meanwhile – in 2017 – things have gotten worse related to SHA-1. Nowadays, there are known collisions for SHA-1 and the graphic changed accordingly.
Related to SHA-1 being unsafe and (meanwhile) practically broken, the following two websites might also be of interest to you:
Freestart Collisions (theoretical, 2015)
Website: The SHAppening: freestart collisions for SHA-1
(Mentioned by Ohad Cohen)This website contains latest news and background information regarding the SHA-1 freestart collision work from Marc Stevens (CWI, the Netherlands), Pierre Karpman (Inria, France and NTU Singapore) and Thomas Peyrin (NTU Singapore).
You can find the latest version of our technical article here (currently under submission) and the corresponding press release here.
…
and
Full Collision (practical, 2017)
Website: SHA-1 has shattered.
(mentioned by Dave L.)…
It is now practically possible to craft two colliding PDF files and obtain a SHA-1 digital signature on the first PDF file which can also be abused as a valid signature on the second PDF file.
…
This result is the product of a long term collaboration between the Cryptology Group at Centrum Wiskunde & Informatica (CWI) - the national research institute for mathematics and computer science in the Netherlands - and the Google Research Security, Privacy and Anti-abuse Group.
…
TL;DR
The practical full collision linked above shows why you should not be using SHA-1 anymore. Instead, consider using safer alternatives… SHA-2, or the newer SHA-3!
So, to answer your question: yes, there are known collisions for SHA-1 at the time of writing this (February 2017). But there are currently no known collisions for SHA-2 (or SHA-3).