SHA-1: Practical Collisions and What Replaced It

SHA-1 uses the same Merkle-Damgard shape as MD5 with a wider 160 bit state and 80 rounds instead of 64. It was the default hash of the web for over a decade: TLS certificates, Git object identifiers, Subversion, and countless internal file manifests all settled on its 40 character hex output. Its retirement took roughly fifteen years from the first theoretical warning to the last browser dropping it.

The 2017 result, published as SHAttered, produced two PDF files with different visible content and one identical SHA-1 digest, at a cost of about 6,500 CPU years and 100 GPU years of computation. That is an identical prefix collision: the attacker controls both documents from the start. The 2020 result went further with a chosen prefix collision, meaning two meaningfully different starting documents can be forced to converge, at a cost then estimated in the tens of thousands of dollars. That price only falls.

As with MD5, no practical preimage attack exists. You cannot take a published SHA-1 digest and work backwards to an input. This is why HMAC-SHA-1 remains acceptable in existing protocols: HMAC's security proof rests on the compression function behaving like a pseudorandom function, not on collision resistance, so the collision results do not carry over.

Where it is wrong today: any certificate, any code signature, any document signature, any integrity check where the two sides of the comparison could come from different parties. Browsers stopped trusting SHA-1 certificates in 2017 and NIST barred it for signature generation. New designs should use SHA-256 by default and SHA3-256 where a different construction is wanted for diversity.

Git is the interesting survivor. Object names are SHA-1 digests, and the collision applies in principle, so Git added a hardened variant that detects the specific disturbance vectors used by known collision attacks and refuses such objects. Migration to SHA-256 repositories exists but is far from universal. And as always, SHA-1 is wrong for passwords: use Argon2id, scrypt or bcrypt, none of which ToolBox provides.