Hash function security summary

This article summarizes publicly known attacks against cryptographic hash functions. Note that not all entries may be up to date. For a summary of other hash function parameters, see comparison of cryptographic hash functions.

Hash function	Security claim	Best attack	Publish date	Comment
MD5	2	2	2009-04-27	Paper.
SHA-1	2	45 of 80 rounds	2008-08-17	Paper.
SHA256	2	43 of 64 rounds (2 time, 2 memory)	2009-12-10	Paper.
SHA512	2	46 of 80 rounds (2 time, 2 memory)	2008-11-25	Paper, updated version.
SHA-3	Up to 2
BLAKE2s	2	2.5 of 10 rounds (2)	2009-05-26	Paper.
BLAKE2b	2	2.5 of 12 rounds (2)	2009-05-26	Paper.

2 time, 2 memory 2009 Slightly less computationally expensive than a birthday attack, but for practical purposes, memory requirements make it more expensive. MD4 2 3 operations 2007-03-22 Finding collisions almost as fast as verifying them. PANAMA 2 2 2007-04-04 Paper, improvement of an earlier theoretical attack from 2001. RIPEMD (original) 2 2 time 2004-08-17 Collisions originally reported in 2004, followed up by cryptanalysis paper in 2005. RadioGatún Up to 2 2 2008-12-04 For a word size w between 1-64 bits, the hash provides a security claim of 2. The attack can find a collision in 2 time. RIPEMD-160 2 48 of 80 rounds (2 time) 2006 Paper. SHA-0 2 2 time 2008-02-11 Two-block collisions using boomerang attack. Attack takes estimated 1 hour on an average PC. Streebog 2 9.5 rounds of 12 (2 time, 2 memory) 2013-09-10 Rebound attack. Whirlpool 2 4.5 of 10 rounds (2 time) 2009-02-24 Rebound attack.

Hash function	Security claim	Best attack	Publish date	Comment
GOST	2	2	2008-08-18	Paper.
MD2	2	2 time, 2 memory	2008	Paper.
MD4	2	2 time, 2 memory	2008-02-10	Paper.
RIPEMD (original)	2	35 of 48 rounds	2011	Paper.
RIPEMD-128	2	35 of 64 rounds
RIPEMD-160	2	31 of 80 rounds
Streebog	2	2 time, 2 data	2014-08-29	The paper presents two second-preimage attacks with variable data requirements.
Tiger	2	2 time, 2 memory	2010-12-06	Paper.

1. ↑ Tao Xie; Fanbao Liu; Dengguo Feng (25 March 2013). "Fast Collision Attack on MD5". IACR Cryptol. ePrint Arch.
2. 1 2 Somitra Kumar Sanadhya; Palash Sarkar (2008-11-25). New Collision Attacks against Up to 24-Step SHA-2. Indocrypt 2008. doi:10.1007/978-3-540-89754-5_8.
3. ↑ L. Song, G. Liao and J. Guo, Non-Full Sbox Linearization: Applications to Collision Attacks on Round-Reduced Keccak, CRYPTO, 2017
4. 1 2 3 4 Yu Sasaki; Kazumaro Aoki (2009-04-27). Finding Preimages in Full MD5 Faster Than Exhaustive Search. Eurocrypt 2009. doi:10.1007/978-3-642-01001-9_8.
5. ↑ Yu Sasaki; Lei Wang; Kazumaro Aoki (2008-11-25). "Preimage Attacks on 41-Step SHA-256 and 46-Step SHA-512". IACR Cryptol. ePrint Arch.
6. 1 2 Xiaoyun Wang; Dengguo Feng; Xiuyuan Yu (October 2005). "An attack on hash function HAVAL-128" (PDF). Science in China Series F: Information Sciences. 48 (5): 545–556. CiteSeerX 10.1.1.506.9546. doi:10.1360/122004-107. Archived from the original (PDF) on 2017-08-09. Retrieved 2014-10-23.{{cite journal}}: Cite uses deprecated parameter |citeseerx= (help)
7. ↑ Joan Daemen; Gilles Van Assche (2007-04-04). Producing Collisions for Panama, Instantaneously. FSE 2007.
8. ↑ Thomas Fuhr; Thomas Peyrin (2008-12-04). Cryptanalysis of RadioGatun. FSE 2009.
9. ↑ Zongyue Wang; Hongbo Yu; Xiaoyun Wang (2013-09-10). "Cryptanalysis of GOST R hash function". Information Processing Letters. 114 (12): 655–662. doi:10.1016/j.ipl.2014.07.007.
10. ↑ Gaëtan Leurent (2008-02-10). MD4 is Not One-Way (PDF). FSE 2008.
11. ↑ Jian Guo; San Ling; Christian Rechberger; Huaxiong Wang (2010-12-06). Advanced Meet-in-the-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2. Asiacrypt 2010. pp. 12–17.
12. ↑ Goodin, Dan (2012-12-10). "25-GPU cluster cracks every standard Windows password in <6 hours". Ars Technica. Retrieved 2020-11-23.