Yes, SHA-1 is broken: its collision resistance has failed in practice. Researchers made the first real full SHA-1 collision in 2017. By 2020, a chosen-prefix collision, the more dangerous kind, was estimated to cost about $45,000 in rented GPU time.<\/p>\n
So if you’re asking whether SHA-1 is broken, the precise answer is that it no longer guarantees two different inputs won’t share a hash. All the attacks below are collision attacks. Below is how the cost dropped from a theoretical result to something you can buy, where SHA-1 still shows up (Git, PGP, DNSSEC), and what NIST’s 2030 deadline means for anyone still using it.<\/p>\n
A cryptographic hash function turns any input into a short, fixed-length digest. One of its main promises is collision resistance<\/strong>: finding two different inputs with the same digest should be infeasible. Signatures, certificates and content-addressed storage all depend on it. When you sign a hash, you are in effect signing every input that produces that hash.<\/p>\n SHA-1 produces a 160-bit digest. The birthday paradox means a generic collision search takes roughly the square root of the output space, not the whole space. For a 160-bit output that’s about 280<\/sup> operations. Brute force can never do better than that, so cryptographers call a hash “broken” for collisions once someone finds a method that’s clearly cheaper than 280<\/sup>.<\/p>\n That definition matters, because “broken” doesn’t mean “anyone can reverse it.” It means the security margin the design promised is gone, and attacks only get cheaper over time.<\/p>\n The first serious break came in February 2005. On February 15, Bruce Schneier reported on his blog<\/a> that Xiaoyun Wang, Yiqun Lisa Yin and Hongbo Yu, “mostly from Shandong University in China,” had found a way to produce full SHA-1 collisions in about 269<\/sup> operations, compared with 280<\/sup> for brute force.<\/p>\n That is 211<\/sup>, or about 2,048 times less work. The same research gave about 239<\/sup> operations for SHA-0 and 233<\/sup> for a 58-round version of SHA-1. Schneier’s headline was blunt, though he noted in the same post that the paper wasn’t generally available yet and he couldn’t confirm the attack was real. He wrote:<\/p>\n “SHA-1 has been broken. Not a reduced-round version. Not a simplified version. The real thing.”<\/p>\n<\/blockquote>\n Nobody actually produced a collision in 2005. 269<\/sup> was still a huge computation at the time. But the result showed that SHA-1’s design had a structural weakness, and further improvements would only lower the cost.<\/p>\n Twelve years later, the theory became a concrete result. On February 23, 2017, CWI Amsterdam (Marc Stevens, Pierre Karpman) and Google (Elie Bursztein, Ange Albertini, Yarik Markov) announced the first SHA-1 collision<\/a> on the Google Security Blog. The attack, called SHAttered, produced two different, valid PDF files with the same SHA-1 hash.<\/p>\n The compute was large but finite. The SHAttered project site<\/a> describes about nine quintillion SHA-1 computations, roughly 6,500 CPU-years plus 110 GPU-years. The accompanying paper, “The first collision for full SHA-1”<\/a>, gives the effort as 263.1<\/sup> calls to SHA-1’s compression function and about “100 GPU years.” It calls the attack “more than 100,000 times faster than a brute force search.”<\/p>\n SHAttered was an identical-prefix<\/strong> collision. Both files start with the same content, and the attacker computes a pair of differing blocks that bring the hash states back together. That’s enough to make two documents that look different but share a hash. The attacker can’t take two arbitrary existing documents and make them collide.<\/p>\n That limit fell in January 2020. Ga\u00ebtan Leurent and Thomas Peyrin published “SHA-1 is a Shambles \u2013 First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust”<\/a>. In a chosen-prefix<\/strong> collision, the attacker picks two different starting points, such as two different names or identities, then computes suffixes that make the full messages hash to the same value.<\/p>\n The paper lowered the cost of both attack types (measured on an Nvidia GTX 970):<\/p>\nWhy 280<\/sup> was the bar<\/h3>\n
2005: Wang, Yin and Yu cut the cost to 269<\/sup><\/h2>\n
\n
SHAttered: the first full SHA-1 collision in 2017<\/h2>\n
SHA-1 chosen-prefix collisions: Shambles and the $45k attack<\/h2>\n