Skip to main content
Cryptanalytic AttackYear: 2017Severity: High

SHAttered: Practical SHA-1 Hash Collision

First real-world SHA-1 collision generated by CIGIT & Google

#SHA-1 Hash Function#Merkle-Damgård Construction

Incident Overview

In February 2017, researchers from CWI Amsterdam and Google announced SHAttered, producing two distinct PDF documents that generated the exact same SHA-1 hash (3870678d4804757c0f5840cb93f1205a271f2601).

Real-World Impact

Forced immediate retirement of SHA-1 in Git, digital certificates, web browsers, and software distribution repositories worldwide.

Technical Root Cause Analysis

Identified differential paths in SHA-1 compression function requiring 2^63.1 SHA-1 evaluations (9,223,372,036,854,775,808 evaluations) to craft two distinct PDF documents with identical SHA-1 hashes.

  • Identical Hash: PDF 1 and PDF 2 differed in JPEG image payload bytes, but compressed to identical SHA-1 digest.
  • Computation Scale: Required 9 quintillion SHA-1 calculations (~6,500 years of single-CPU computation or 110 GPU-years).
  • Git & SVN Impact: Demonstrated SVN repository corruption where committing PDF 2 overwrote PDF 1.

SHAttered SHA-1 Collision Verification

# Both files have identical SHA-1 hashes:
$ sha1sum shattered-1.pdf shattered-2.pdf
3870678d4804757c0f5840cb93f1205a271f2601  shattered-1.pdf
3870678d4804757c0f5840cb93f1205a271f2601  shattered-2.pdf

# SHA-256 correctly produces distinct hashes:
$ sha256sum shattered-1.pdf shattered-2.pdf
2570889f1d59bc36b0630f... shattered-1.pdf
71b239df6822b6131d234a... shattered-2.pdf

Incident Timeline

2005

Xiaoyun Wang proves theoretical SHA-1 collision attack in 2^69 operations.

2011

NIST formally deprecates SHA-1 for digital signatures.

2017-02-23

CWI and Google publish SHAttered attack details and 2 distinct PDFs.

Key Engineering Takeaway & Defensive Guidance

Deprecate legacy cryptographic primitives (SHA-1, MD5) before practical collision attacks emerge. Migrate to SHA-256, SHA-3, or BLAKE2.