Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack?
All hashes that are nowadays considered 'broken' (such as MD5 and MD4 and older, and to some extent also SHA-1) are only susceptible to collision attacks, i.e. generating two arbitrary chunks of data with the same hash.
I'm wondering if a successful preimage attack has ever been found for any hash algorithm? And I mean either kind of preimage attack:
- Regular, i.e. given a hash output H, being able to generate some data X so hash(X) = H
- Secondary, i.e. given data X, being able to generate some other data Y so hash(X)=hash(Y)
And with 'feasible' I mean it can be done on a reasonably powerful cluster of fast computers (with fast GPUs) within reasonable time (e.g. 6 months).