Hubbry Logo
Hash function security summaryHash function security summaryMain
Open search
Hash function security summary
Community hub
Hash function security summary
logo
7 pages, 0 posts
0 subscribers
Be the first to start a discussion here.
Be the first to start a discussion here.
Contribute something
Hash function security summary
Hash function security summary
Hash function security summary
View on Wikipedia
from Wikipedia

This article summarizes publicly known attacks against cryptographic hash functions. Note that not all entries may be up to date. For a summary of other hash function parameters, see comparison of cryptographic hash functions.

Table color key

[edit]
See also: Security level
  No attack successfully demonstrated — attack only breaks a reduced version of the hash or requires more work than the claimed security level of the hash
  Attack demonstrated in theory — attack breaks all rounds and has lower complexity than security claim
  Attack demonstrated in practice — complexity is low enough to be actually used

Common hash functions

[edit]

Collision resistance

[edit]
Main article: Collision attack
Hash function Security claim Best attack Publish date Comment
MD5 264 218 time 2013-03-25 This attack takes seconds on a regular PC. Two-block collisions in 218, single-block collisions in 241.[1]
SHA-1 280 261.2 2020-01-08 Paper by Gaëtan Leurent and Thomas Peyrin[2]
SHA256 2128 31 of 64 rounds (265.5) 2013-05-28 Two-block collision.[3]
SHA512 2256 24 of 80 rounds (232.5) 2008-11-25 Paper.[4]
SHA-3 Up to 2512 6 of 24 rounds (250) 2017 Paper.[5]
BLAKE2s 2128 2.5 of 10 rounds (2112) 2009-05-26 Paper.[6]
BLAKE2b 2256 2.5 of 12 rounds (2224) 2009-05-26 Paper.[6]

Chosen prefix collision attack

[edit]
Hash function Security claim Best attack Publish date Comment
MD5 264 239 2009-06-16 This attack takes hours on a regular PC.[7]
SHA-1 280 263.4 2020-01-08 Paper by Gaëtan Leurent and Thomas Peyrin[2]
SHA256 2128
SHA512 2256
SHA-3 Up to 2512
BLAKE2s 2128
BLAKE2b 2256

Preimage resistance

[edit]
Main article: Preimage attack
Hash function Security claim Best attack Publish date Comment
MD5 2128 2123.4 2009-04-27 Paper.[8]
SHA-1 2160 45 of 80 rounds 2008-08-17 Paper.[9]
SHA256 2256 43 of 64 rounds (2254.9 time, 26 memory) 2009-12-10 Paper.[10]
SHA512 2512 46 of 80 rounds (2511.5 time, 26 memory) 2008-11-25 Paper,[11] updated version.[10]
SHA-3 Up to 2512
BLAKE2s 2256 2.5 of 10 rounds (2241) 2009-05-26 Paper.[6]
BLAKE2b 2512 2.5 of 12 rounds (2481) 2009-05-26 Paper.[6]

Length extension

[edit]
Main article: Length extension attack
  • Vulnerable: MD5, SHA1, SHA256, SHA512
  • Not vulnerable: SHA384, SHA-3, BLAKE2

Less-common hash functions

[edit]

Collision resistance

[edit]
Hash function Security claim Best attack Publish date Comment
GOST 2128 2105 2008-08-18 Paper.[12]
HAVAL-128 264 27 2004-08-17 Collisions originally reported in 2004,[13] followed up by cryptanalysis paper in 2005.[14]
MD2 264 263.3 time, 252 memory 2009 Slightly less computationally expensive than a birthday attack,[15] but for practical purposes, memory requirements make it more expensive.
MD4 264 3 operations 2007-03-22 Finding collisions almost as fast as verifying them.[16]
PANAMA 2128 26 2007-04-04 Paper,[17] improvement of an earlier theoretical attack from 2001.[18]
RIPEMD (original) 264 218 time 2004-08-17 Collisions originally reported in 2004,[13] followed up by cryptanalysis paper in 2005.[19]
RadioGatún Up to 2608[20] 2704 2008-12-04 For a word size w between 1-64 bits, the hash provides a security claim of 29.5w. The attack can find a collision in 211w time.[21]
RIPEMD-160 280 48 of 80 rounds (251 time) 2006 Paper.[22]
SHA-0 280 233.6 time 2008-02-11 Two-block collisions using boomerang attack. Attack takes estimated 1 hour on an average PC.[23]
Streebog 2256 9.5 rounds of 12 (2176 time, 2128 memory) 2013-09-10 Rebound attack.[24]
Whirlpool 2256 4.5 of 10 rounds (2120 time) 2009-02-24 Rebound attack.[25]

Preimage resistance

[edit]
Hash function Security claim Best attack Publish date Comment
GOST 2256 2192 2008-08-18 Paper.[12]
MD2 2128 273 time, 273 memory 2008 Paper.[26]
MD4 2128 2102 time, 233 memory 2008-02-10 Paper.[27]
RIPEMD (original) 2128 35 of 48 rounds 2011 Paper.[28]
RIPEMD-128 2128 35 of 64 rounds
RIPEMD-160 2160 31 of 80 rounds
Streebog 2512 2266 time, 2259 data 2014-08-29 The paper presents two second-preimage attacks with variable data requirements.[29]
Tiger 2192 2188.8 time, 28 memory 2010-12-06 Paper.[30]

Attacks on hashed passwords

[edit]
Main article: Password cracking

Hashes described here are designed for fast computation and have roughly similar speeds.[31] Because most users typically choose short passwords formed in predictable ways, passwords can often be recovered from their hashed value if a fast hash is used. Searches on the order of 100 billion tests per second are possible with high-end graphics processors.[32][33] Special hashes called key derivation functions have been created to slow brute force searches. These include pbkdf2, bcrypt, scrypt, argon2, and balloon.

See also

[edit]

References

[edit]
[edit]
Revisions and contributorsEdit on WikipediaRead on Wikipedia

Hash function security summary

View on Grokipedia
from Grokipedia
A cryptographic hash function is a mathematical that transforms an input of arbitrary length into a fixed-size output, called a hash value or digest, which serves as a unique digital fingerprint for verifying and authenticity in applications. The security of these functions is fundamentally assessed through three core properties: preimage resistance, where it is computationally infeasible to reverse the hash to find the original input from a given output; second-preimage resistance, where finding a different input that produces the same output as a given input is infeasible; and , where discovering any two distinct inputs that yield the same output is computationally infeasible. These properties ensure that hash functions resist common attacks, such as brute-force inversion or deliberate , making them essential for protocols like digital signatures, message authentication codes (MACs), and key derivation. For instance, preimage resistance protects against attempts to forge inputs for known hashes, as used in verification systems, while safeguards against creating fraudulent data that matches legitimate hashes, critical in certificate authorities. Second-preimage resistance complements this by preventing targeted substitutions, such as altering a specific without detection. The implications of these properties are interconnected: implies second-preimage resistance, but not necessarily preimage resistance, highlighting the need for functions robust across all three for high-security use cases. In practice, the U.S. National Institute of Standards and Technology (NIST) approves hash functions based on their demonstrated strengths, measured in bits (e.g., 128-bit for SHA-256). Approved algorithms include the family (SHA-224, SHA-256, SHA-384, SHA-512) from FIPS 180-4 and the family (SHA3-224, SHA3-256, SHA3-384, SHA3-512) from FIPS 202, with , which was progressively deprecated starting in 2011 due to theoretical weaknesses and fully broken by practical collision attacks in 2017, with NIST requiring phase-out by December 31, 2030 as announced in 2022. These standards specify that approved functions provide at least 112 bits of for the shortest variants, scaling up to 256 bits or more, ensuring resistance against quantum-assisted threats where applicable. Additionally, extendable-output functions (XOFs) like SHAKE128 and SHAKE256 offer flexible digest lengths while maintaining similar guarantees. Historical vulnerabilities, such as collisions in (1996 theoretical, 2004 practical) and , underscore the importance of ongoing and transitions to stronger primitives like , selected in 2012 via NIST's to replace aging standards. Overall, evolves with computational advances, emphasizing the need for functions with output sizes of at least 256 bits to achieve 128-bit levels against modern adversaries.

Fundamental Security Properties

Preimage Resistance

Preimage resistance, a core security property of cryptographic hash functions, ensures that given a hash output hh, it is computationally infeasible for an adversary to find any input message mm such that \hash(m)=h\hash(m) = h. This property, also referred to as one-wayness, underpins the irreversibility of the hashing process and is essential for preventing inversion attacks. The theoretical security level of preimage resistance is quantified by the expected work factor required to succeed, which for a on an nn-bit hash output is 2n2^n operations. This complexity arises because an attacker must effectively search the entire input space to reverse the hash, assuming the function behaves like a . In practice, this makes preimage attacks impractical for sufficiently large nn, such as 256 bits in modern standards. Preimage resistance differs from other hash properties like , as it specifically targets the reversal of a single given output rather than finding pairs of inputs that map to the same output. In the Merkle-Damgård construction, of the compression function implies for the full , which in turn implies second-preimage resistance, but not necessarily preimage resistance. The notion was first formalized in the late 1970s by , who introduced one-way hash functions as a in his doctoral thesis, emphasizing their role in secure protocols. This idea was extended in the 1980s through the independent works of Merkle and Ivan Damgård, establishing design principles for iterative hash constructions that inherit one-wayness from underlying components. In digital signatures, preimage resistance is vital, as it guarantees that an attacker cannot construct a fraudulent from a legitimately signed hash value, thereby preserving the and authenticity of signed documents. Without this property, signature schemes relying on hashed messages would be vulnerable to .

Second Preimage Resistance

Second preimage resistance, also known as weak collision resistance, is a core property of cryptographic hash functions. It requires that, given a m1m_1 and its hash value h=hash(m1)h = \text{hash}(m_1), it is computationally infeasible for an adversary to find a distinct message m2≠m1m_2 \neq m_1 such that hash(m2)=h\text{hash}(m_2) = h. This property targets the difficulty of generating a specific alternative input that collides with the hash of a known input, distinguishing it from preimage resistance, which concerns finding any input mapping to a given output without reference to a particular input. The theoretical security level of second preimage resistance aligns with the output size of the . For an nn-bit hash output, a brute-force search to find a second preimage requires approximately 2n2^n hash computations, as the attacker must evaluate hashes until matching the target value. This complexity assumes no structural weaknesses, making it comparable to preimage resistance in generic attacks but more targeted in practice. Although weaker than —since collision resistance implies second preimage resistance but not vice versa—this property remains essential for protocols relying on hash-based integrity verification, where swapping one verified input for another must be prevented. For instance, in and integrity checks, it ensures that a legitimate file cannot be replaced by a malicious variant sharing the same hash, thwarting tampering attempts during validation. Many second preimage attacks exploit vulnerabilities in the compression function underlying common hash constructions, such as those in the Merkle-Damgård paradigm, allowing attackers to manipulate intermediate states more efficiently than brute force.

Collision Resistance

Collision resistance is a fundamental security property of cryptographic , defined as the computational infeasibility of finding two distinct inputs m1≠m2m_1 \neq m_2 such that \hash(m1)=\hash(m2)\hash(m_1) = \hash(m_2). This property ensures that the hash function behaves like a in mapping inputs to outputs, making it extremely difficult for an adversary to deliberately produce colliding messages without exhaustive search. Unlike preimage resistance, which targets reversing a specific output, focuses on discovering any pair of inputs that share the same hash value, regardless of the target. The theoretical complexity of breaking is significantly reduced by the , which exploits the birthday paradox to find collisions with effort approximately 2n/22^{n/2} for an nn-bit hash output, rather than the full 2n2^n expected for brute force. This attack involves generating roughly 2n\sqrt{2^n}
Add your contribution
Related Hubs
Contribute something
User Avatar
No comments yet.