Linked Questions

42 votes
2 answers
34k views

Are there any known collisions for the SHA (1 & 2) family of hash functions?

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512? By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?
Pacerier's user avatar
  • 1,265
52 votes
2 answers
15k views

Why is SHA-1 considered broken?

Is there a known pair of distinct bit strings (A,B) such that SHA-1(A) == SHA-1(B)? If the answer is no, then how can SHA-1 be considered broken?
Andrew Tomazos's user avatar
46 votes
1 answer
7k views

What is a "freestart collision"?

In their work on SHA-1 collisions (cf. the EUROCRYPT-2016 paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ...
otus's user avatar
  • 32.2k
9 votes
3 answers
3k views

SHA-1 collisions - what about practical attacks?

I understand the theoretical problem with hash collision but when it comes to practice, I get very confused. Suppose a attacker would like to forge a certificate (or any kind of structured piece of ...
crypto-learner's user avatar
2 votes
2 answers
3k views

Finding collisions in SHA1

I am trying to find two collisions in SHA1 for the 50 least significant bits. I was wondering if there was a way to efficiently do this without having to brute force all of the possible hash outputs? ...
winsticknova's user avatar
7 votes
2 answers
822 views

Does a practical collision attack on a cryptographic hash function also mean it fails “indistinguishable from random data”?

It is knowns that SHA-1 has been broken in practice using collision attacks. Related to SHA-1 this mainly had a negative impact on the security of Digital Certificate signatures Email PGP/GPG ...
e-sushi's user avatar
  • 17.9k
4 votes
2 answers
358 views

Are there valid attacks on full SHA-1?

Google today announced they are sunsetting SHA-1. Its fine by me. But that made me realize I am not keeping up with the research on SHA-1. The Wikipedia page only says Stevens' attack is the most ...
user220201's user avatar
2 votes
1 answer
1k views

Brute-force attacks practical limit

My question is about practical limit for brute force attacks. As I know 3DES with 56 bits key length can be broken via brute force. I also heard the same news about 64 bit key length (correct me if I ...
Ivan's user avatar
  • 145
6 votes
1 answer
791 views

Difference between actual attacks and theoretical attacks on SHA cryptographic series

Could anyone tell me what the difference is between a theoretical attack (Like the one done on SHA-1) and an actual, practical attack (Like the one done on SHA-0)? Is a theoretical attack a proposed ...
Thomas Gouder's user avatar
0 votes
1 answer
332 views

Is there an outdated or insecure hash algorithm thats output can be easily reversed back into the input?

I'm looking for a hash algorithm thats output can be reversed back into the input in a reasonable amount of time (a day or less) using a decent consumer computer. If anyone has any information on this,...
Sir Wumpus IV's user avatar