SHAttered: Practical SHA-1 Hash Collision
First real-world SHA-1 collision generated by CIGIT & Google
Incident Overview
In February 2017, researchers from CWI Amsterdam and Google announced SHAttered, producing two distinct PDF documents that generated the exact same SHA-1 hash (3870678d4804757c0f5840cb93f1205a271f2601).
Real-World Impact
Forced immediate retirement of SHA-1 in Git, digital certificates, web browsers, and software distribution repositories worldwide.
Technical Root Cause Analysis
Identified differential paths in SHA-1 compression function requiring 2^63.1 SHA-1 evaluations (9,223,372,036,854,775,808 evaluations) to craft two distinct PDF documents with identical SHA-1 hashes.
- Identical Hash: PDF 1 and PDF 2 differed in JPEG image payload bytes, but compressed to identical SHA-1 digest.
- Computation Scale: Required 9 quintillion SHA-1 calculations (~6,500 years of single-CPU computation or 110 GPU-years).
- Git & SVN Impact: Demonstrated SVN repository corruption where committing PDF 2 overwrote PDF 1.
SHAttered SHA-1 Collision Verification
# Both files have identical SHA-1 hashes:
$ sha1sum shattered-1.pdf shattered-2.pdf
3870678d4804757c0f5840cb93f1205a271f2601 shattered-1.pdf
3870678d4804757c0f5840cb93f1205a271f2601 shattered-2.pdf
# SHA-256 correctly produces distinct hashes:
$ sha256sum shattered-1.pdf shattered-2.pdf
2570889f1d59bc36b0630f... shattered-1.pdf
71b239df6822b6131d234a... shattered-2.pdfIncident Timeline
Xiaoyun Wang proves theoretical SHA-1 collision attack in 2^69 operations.
NIST formally deprecates SHA-1 for digital signatures.
CWI and Google publish SHAttered attack details and 2 distinct PDFs.
Key Engineering Takeaway & Defensive Guidance
Deprecate legacy cryptographic primitives (SHA-1, MD5) before practical collision attacks emerge. Migrate to SHA-256, SHA-3, or BLAKE2.