I was looking a Wikipedia article on SHA-2, and the "Comparison of SHA functions" table seems to indicate that SHA-2 is less secure than SHA-1.

enter image description here

Is this true, or is the table wrong / misleading?

What does $2^{28.5}$ mean for SHA-256 compared to $2^{60}$ for SHA-1 (table in SHA-1 article says $2^{53}$)? How does it relate to MD5 article, which says:

The security of the MD5 hash function is severely compromised. A collision attack exists that can find collisions within seconds on a computer with a 2.6 GHz Pentium 4 processor (complexity of $2^{24.1}$)

Assuming that no collisions have been found for the SHA-2 family, does that still mean it takes less work to find a collision than SHA-1? Or do these numbers ($2^{28.5}$, $2^{60}$, $2^{53}$, $2^{24.1}$) mean different things?

If the table is wrong, how should it be corrected?

  • 2
    $\begingroup$ The :24 is probably referring to a version reduced to 24 rounds. $\endgroup$ May 20, 2013 at 23:01
  • 5
    $\begingroup$ I corrected the table to say "None (For a 24-round variant: $2^{28.5}$)". Thanks for finding this. $\endgroup$ May 21, 2013 at 4:23
  • $\begingroup$ @PaŭloEbermann: Nit-pick, but if reduced round attacks are relevant, if found at least one against 2 round Keccak: naya.plasencia.free.fr/Maria/papers/Keccak_differential.pdf $\endgroup$ May 21, 2013 at 8:39
  • 1
    $\begingroup$ @HenrickHellström So you are saying we should simply write "None" here, or that we should add the attacks for Keccak too? I wanted to do a minimal change which still is correct. $\endgroup$ May 21, 2013 at 9:12
  • 1
    $\begingroup$ @Paŭlo Ebermann: What about a separate column for the best reduced-round attacks? $\endgroup$
    – fgrieu
    May 21, 2013 at 11:13

1 Answer 1


No. The wikipedia article is in my honest opinion misrepresenting this article on a reduced round attack on the SHA-2 family of hashes.

Although these attacks improve upon the existing reduced round SHA-2 attacks, they do not threaten the security of the full SHA-2 family.

In other words, no collisions have been found in any of the SHA-2 hashes.

The numbers that the are shown in the table mean different things for SHA-1 and SHA-2. In the case of SHA-1, the theoretical attack finds a collision in the actual SHA-1 algorithm. In the case of SHA-2, the collision is found in a modified algorithm with only 24 of the normal 64/80 rounds. In practice, this means that the best collision attack against SHA-256 still has the theoretical upper bound of $2^{128}$ complexity, and the best collision attack against SHA-512 a $2^{256}$ complexity.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.