36
$\begingroup$

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512?

By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?

$\endgroup$
33
$\begingroup$

This answer is now out of date as on Feb 23 2017, a collision for SHA-1 was found. See What is the new attack on SHA-1 “SHAttered” and how does it work?

In short, no.

So, what is the current state of cryptanalysis with SHA-1 (for reference only as this question relates to SHA-2) and SHA-2? Bruce Schneier has declared SHA-1 broken. That is because researchers found a way to break full SHA-1 in $2^{69}$ operations. Much less than the $2^{80}$ operations it should take to find a collision due to the birthday paradox.

As far as we know, the best available collision attacks on full round SHA-2 hash functions is still brute force $2^{n/2}$ (where $n$ is the bit length of the output).

$\endgroup$
  • $\begingroup$ That's why even after Keccak was selected as the winner of the SHA3 competition, NIST emphasized that it is not meant to replace SHA-2. $\endgroup$ – Qiu Jul 23 '13 at 9:17
  • $\begingroup$ This answer is now out of date, because a SHA-1 collision has been published. $\endgroup$ – Luis Casillas Feb 23 '17 at 22:46
28
$\begingroup$

First up, the following table should provide a nice comparison of the SHA algorithms and their status back in 2013, when I fist posted this answer:

Comparison of SHA functions

[38] The theoretical attack on SHA-1 refers to “Freestart collision for full SHA-1” (PDF) by Marc Stevens and Pierre Karpman and Thomas Peyrin, first published 8 October 2015.

Meanwhile – in 2017 – things have gotten worse related to SHA-1. Nowadays, there are known collisions for SHA-1 and the graphic changed accordingly.

Comparison of SHA functions

Related to SHA-1 being unsafe and (meanwhile) practically broken, the following two websites might also be of interest to you:

  • Freestart Collisions (theoretical, 2015)

    Website: The SHAppening: freestart collisions for SHA-1
    (Mentioned by Ohad Cohen)

    This website contains latest news and background information regarding the SHA-1 freestart collision work from Marc Stevens (CWI, the Netherlands), Pierre Karpman (Inria, France and NTU Singapore) and Thomas Peyrin (NTU Singapore).

    You can find the latest version of our technical article here (currently under submission) and the corresponding press release here.

and

  • Full Collision (practical, 2017)

    Website: SHA-1 has shattered.
    (mentioned by Dave L.)

    It is now practically possible to craft two colliding PDF files and obtain a SHA-1 digital signature on the first PDF file which can also be abused as a valid signature on the second PDF file.

    This result is the product of a long term collaboration between the Cryptology Group at Centrum Wiskunde & Informatica (CWI) - the national research institute for mathematics and computer science in the Netherlands - and the Google Research Security, Privacy and Anti-abuse Group.

TL;DR

The practical full collision linked above shows why you should not be using SHA-1 anymore. Instead, consider using safer alternatives… SHA-2, or the newer SHA-3!

So, to answer your question: yes, there are known collisions for SHA-1 at the time of writing this (February 2017). But there are currently no known collisions for SHA-2 (or SHA-3).

$\endgroup$

protected by Maarten Bodewes Feb 23 '17 at 21:50

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.