How the Hash Functions Broke in Real Life: MD5, Flame, SHATTERED, and the Long Death of SHA-1

1. The Forged Certificate That Rode Windows Update#

In the spring of 2012, espionage malware called Flame spread through the Middle East wearing a disguise almost nothing could see through: it arrived signed by Microsoft, and reached some targets through Windows Update itself ^[1]. To a defending machine, it looked like a legitimate patch from the one vendor it trusted most. To forge that signature, its operators did something the open cryptographic literature had not yet published. They engineered a chosen-prefix collision in MD5 -- a hash academics had called broken since 2004 ^[2] -- and counterfeited a certificate that chained up to Microsoft's own root of trust ^[3].

The certificate they forged was not a plainly-issued code-signing certificate. It was a Terminal Server Licensing Service certificate living inside Microsoft's Enforced Licensing public-key infrastructure -- an obscure corner of Microsoft's PKI that the company was, in 2012, still signing with MD5. When Microsoft published Security Advisory 2718704 on 3 June 2012, the fix was to revoke exactly those certificates: the "Microsoft Enforced Licensing Intermediate PCA" and the "Microsoft Enforced Licensing Registration Authority CA" ^[4].

The unsettling part of Flame is not that the math failed. It is that the math had failed nearly a decade earlier, in a Chinese cryptographer's paper read at a 2004 conference, and Microsoft's licensing servers were still signing with it eight years later. A broken primitive sat, patiently, underneath a live production certificate authority until someone with a nation-state budget decided to point a collision at it.

Now hold one more artifact in your head, because you will learn to read it by the end of this article. It is a SHA-1 digest:

38762cf7f55934b34d179ae6a4c80cadccbb7f0a

In February 2017, researchers at CWI Amsterdam and Google published two different PDF files that both hash to exactly that value ^[5]. Two distinct documents, one fingerprint -- a thing that was supposed to be computationally impossible for the hash guarding TLS certificates, Git commits, and software signatures across the internet.

That diagnostic sentence is the spine of everything that follows. It is also why this article is the honest exception in a series otherwise arguing that the deployment breaks, not the math. Here the math genuinely broke. And even here, on the one topic where the primitive itself fell, no attacker ever won on cryptanalysis alone. They won where broken math met a system still trusting it.

So if MD5 was known-broken years before Flame, why was anything still signing with it? To answer that, we have to be precise about what a hash actually promises -- because only one of its promises is fragile, and it is the exact one a certificate leans on.

2. What a Hash Promises, and Which Clause Is Fragile#

A cryptographic hash function makes three separate promises. They sound similar, they are routinely confused, and telling them apart is the difference between understanding this whole story and mis-stating it. Only one of the three is fragile, and it is the one certificates depend on.

The gap between those last two properties is not cosmetic; it is exponential, and it has a name.

That square-root haircut is brutal. By that bound, a 128-bit MD5 digest ^[6] offers only about $2^{64}$ collision security, and a 160-bit SHA-1 digest only about $2^{80}$. Preimage and second-preimage attacks still cost close to the full $2^{128}$ or $2^{160}$, which is why -- spoiler for Section 8 -- those properties survived while collision resistance did not. When you hear "MD5 is broken," the precise statement is "MD5's roughly $2^{64}$ collision barrier fell far below $2^{64}$." It is not "you can invert an MD5 hash."

One construction under all of them#

MD5, SHA-1, and SHA-2 are not three unrelated designs. They are three members of one family, built from the same skeleton.

flowchart LR
IV["Fixed IV"] --> F1["Compress"]
M1["Block 1"] --> F1
F1 --> F2["Compress"]
M2["Block 2"] --> F2
F2 --> F3["Compress"]
M3["Block 3 plus length padding"] --> F3
F3 --> D["Digest"]

Ronald Rivest published MD5 in April 1992 as RFC 1321, producing a 128-bit digest ^[6]. Rivest is the "R" in RSA. MD5 was his hardened successor to MD4, and RFC 1321 says it "backs off" from MD4's speed for a "greater likelihood of ultimate security." The US government's SHA lineage followed a parallel path: SHA (retroactively SHA-0) arrived in FIPS 180 in 1993, and SHA-1 replaced it in FIPS 180-1 on 17 April 1995 with a 160-bit digest ^[7]. SHA-0 was withdrawn within about two years for an undisclosed weakness. SHA-1 differs from it by a single added one-bit rotation in the message schedule -- a fix whose importance Section 3 makes concrete.

Why a collision is a forgery#

Here is the load-bearing fact that ties the fragile clause to the real world. A digital signature does not sign your whole message. It signs the hash of your message, because the message may be gigabytes and the signing math is slow. The signer computes a digest, then encrypts that short digest with a private key.

flowchart TD
M1["Message A, benign"] --> H["Hash function"]
M2["Message B, malicious"] --> H
H --> D["One shared digest"]
D --> S["Signer signs the digest"]
S --> Sig["A single signature"]
Sig --> Cover["Valid for A and for B"]

Follow the consequence. If an attacker finds two messages with the same digest, and persuades someone to sign the harmless one, that same signature is automatically valid on the malicious one. The certificate authority signs a benign-looking certificate request; the attacker walks away with a valid signature on a forged certificate that shares its hash. Collision resistance is the only thing standing between "sign this document" and "you just signed a document you never saw."

import math

# Collision work is about 2^(n/2), not 2^n, for an n-bit digest.
for name, n in [("MD5", 128), ("SHA-1", 160), ("SHA-256", 256)]:
  collision_exponent = n // 2
  print(name, "-", n, "bit digest ->", "collision work about 2^" + str(collision_exponent))

# Intuition: after hashing roughly 1.2 * sqrt(2^n) random messages,
# a collision is more likely than not.
n = 128
threshold = 1.2 * math.sqrt(2 ** n)
print("MD5: about {:.2e} messages before a coin-flip collision".format(threshold))

RFC 1321 never proved MD5 collision-resistant. It only conjectured the property, in a sentence worth reading with hindsight.

"It is conjectured that it is computationally infeasible to produce two messages having the same message digest." -- RFC 1321, 1992 ^[6]

A conjecture, never a theorem. Cryptographers knew the difference, and some of them had already started chipping at the conjecture the year before Rivest even published. So they warned everyone. Did anyone listen?

3. The Writing on the Wall#

For more than a decade before anyone forged anything, cryptographers kept saying the same thing about MD5: stop using it. Almost nobody did. The story of that decade is a slow-motion argument between two groups who were both right on their own terms -- academics who could see the primitive weakening, and deployers who could not yet see a working attack, and so kept shipping.

The first crack appeared a year after MD5 shipped. In 1993, Bert den Boer and Antoon Bosselaers found a pseudo-collision in MD5's compression function: two different initial values that, with the right inputs, produced the same output ^[8]. This was not a break of MD5 as deployed, because real MD5 fixes the initial value to a constant. It was a warning that the internal machine was not the ideal object it was assumed to be.

Three years later the warning got louder. In 1996, Hans Dobbertin found an actual collision in MD5's compression function -- same fixed structure, colliding outputs ^[9]. Dobbertin's result circulated as a rump-session manuscript and a writeup in RSA's newsletter CryptoBytes 2(2), not as a refereed EUROCRYPT '96 proceedings paper, a detail frequently miscited. Its existence is corroborated by RFC 2104's reference list. Dobbertin himself told people to migrate. The response from the deploying world was, roughly, that a compression-function collision is not a full-message collision, and until someone shows two real files with the same MD5, there is nothing to fix. They were technically correct, and that correctness bought them eight more years of complacency.

The government's SHA line got its own warning shot in 1998, when Florent Chabaud and Antoine Joux demonstrated differential collisions in SHA-0 ^[10]. Their paper mattered beyond SHA-0 for two reasons. First, it introduced the differential-path method -- steering tiny input differences through the rounds so they cancel -- that would later break MD5 and SHA-1 for real. Second, it proved that the single one-bit rotation NIST had quietly added to turn SHA-0 into SHA-1 was load-bearing: exactly the fix that made SHA-1 resist the SHA-0 attack. The lineage was visibly fragile, and its designers knew which thread to pull.

2004: the conjecture falls#

Then came the hinge year. At the CRYPTO 2004 rump session, Xiaoyun Wang and colleagues Dengguo Feng, Xuejia Lai, and Hongbo Yu presented the first practical full MD5 collision -- two complete messages with the same digest, found not in theory but in hours of computation ^[2]. The result was announced to a packed rump-session room and formalized the next year as "How to Break MD5 and Other Hash Functions" at EUROCRYPT 2005. The next year, Wang and Yu published the method in full ^[11], and Wang, with Yiqun Lisa Yin and Hongbo Yu, turned the same differential machinery on SHA-1: an attack at roughly $2^{69}$ operations, comfortably below SHA-1's $2^{80}$ birthday bound, and the first sign that SHA-1's clock was running too ^[12].

The escalation is the whole point. The warnings climbed a ladder of severity: the compression function is not ideal (1993), the compression function collides (1996), the design method is exploitable (1998), here are two real colliding files (2004), and the successor is falling too (2005). At each rung, deployers had a defensible reason to wait -- until the rung above made waiting indefensible.

And yet here is the puzzle that should bother you. Wang produced real, reproducible MD5 collisions in 2004. Certificate authorities kept issuing MD5-signed certificates until 2008 and beyond. Were they simply negligent for four years? Not entirely. Because in 2004, a collision still could not target a victim. Understanding why not is the single most important idea in this article.

4. The Collision-Capability Ladder#

Here is the counterintuitive fact that explains the four-year gap between Wang's 2004 collision and the first real forgery in 2008: a hash collision is not automatically a forgery. Wang could produce two files with the same MD5 digest, but she could not choose what those two files said. That distinction is not a footnote. It is the entire difference between an academic curiosity and a weapon, and it sorts the whole history into a four-rung ladder, where each rung is strictly more dangerous than the one below.

flowchart TD
R1["Rung 1, compression-function or pseudo-collision, free IV"] --> R2["Rung 2, identical-prefix collision, near-twin messages"]
R2 --> R3["Rung 3, chosen-prefix collision, two chosen identities"]
R3 --> R4["Rung 4, weaponization against a still-live deployment"]

Rung 1 we have already met: pseudo-collisions and compression-function collisions, where the attacker is allowed to vary the initial value ^{[8, 9]}. These are warnings, not weapons, because a deployed hash nails the IV to a published constant. The attacker never gets that freedom in the field.

Rung 2 is the identical-prefix collision, and it is what Wang achieved for MD5 in 2004.

An identical-prefix collision is genuinely dangerous to some systems. It breaks naive content-addressing and adversarial deduplication, because two different byte streams now share an identifier. It is exactly what SHATTERED delivered against SHA-1 in 2017: two PDFs, same prefix, same $2^{63.1}$-effort collision, same digest 38762cf7... ^[5]. But notice what it cannot do. It cannot collide a certificate that says "example.com, not a CA" with one that says "any website, is a CA," because those two documents do not share a prefix -- they differ in the fields that matter most. For that, you need the top rung.

Rung 3 is the chosen-prefix collision, and it is the hinge of this entire article.

flowchart LR
subgraph IP["Identical-prefix"]
P1["Shared prefix P"] --> C1["Collision blocks"]
C1 --> O1["One digest, near-twin messages"]
end
subgraph CP["Chosen-prefix"]
A1["Prefix A, chosen"] --> B1["Bridging near-collision blocks"]
Z1["Prefix B, chosen"] --> B1
B1 --> O2["One digest, two different identities"]
end

Marc Stevens, Arjen Lenstra, and Benne de Weger built the first chosen-prefix collision for MD5 in 2007, and demonstrated it with two X.509 certificates for two different identities sharing one MD5 digest ^[13]. That result, more than Wang's, is the moment MD5 became forgeable in practice rather than in principle ^[14]. Rung 4 -- pointing that capability at a real, still-MD5 certificate authority -- is Section 5.

Chosen-prefix is the hinge. An identical-prefix collision makes look-alike twins that cannot lie about who they are. A chosen-prefix collision forges two different identities under one digest. Everything that separates "SHA-1 is theoretically dead" from "your certificate was just counterfeited" lives on that one rung.

Two ladders that rhyme#

The remarkable thing is that SHA-1 climbed the exact same ladder as MD5, roughly a decade behind, rung for rung.

timeline
title Two rhyming ladders, MD5 and SHA-1
section MD5, 1992 to 2012
1992 : MD5 published in RFC 1321
1993 : Compression-function pseudo-collision
1996 : Compression-function collision
2004 : First practical identical-prefix collision
2007 : First chosen-prefix collision
2008 : Rogue CA weaponization
2012 : Flame, a novel chosen-prefix collision
section SHA-1, 1995 to 2020
1995 : SHA-1 published in FIPS 180-1
1998 : SHA-0 differential collisions
2005 : First theoretical attack below the bound
2015 : Freestart collision for full SHA-1
2017 : SHATTERED identical-prefix collision
2020 : Shambles chosen-prefix collision

SHA-1's descent ran from the 2005 theoretical attack, through a 2015 freestart collision that showed a real one was imminent ^[15], to SHATTERED's identical-prefix collision in 2017 ^[5], and finally to a chosen-prefix collision in 2020 ^[16]. Same four rungs, same order.

So by 2007, the world contained a laboratory capability to forge a certificate for anyone, under MD5. All it needed was a certificate authority still willing to sign with MD5. There was one. There were several.

5. Weaponization: Where Capability Met a Deprecated-but-Still-Live Deployment#

A chosen-prefix collision is inert. On its own it is a lab artifact, a pair of files in a researcher's directory. It becomes a breach only when it is pointed at a system that is still signing with the broken hash. Watch that happen four times over twelve years, and each time, look for the second failure -- the one that is not about mathematics at all.

2008: the rogue certificate authority#

In December 2008, a team including Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik, and Benne de Weger walked onstage at the 25th Chaos Communication Congress and announced that they had forged a certificate authority. Not stolen one -- forged one, with mathematics ^[17]. They obtained a legitimate end-entity certificate from the commercial CA RapidSSL, whose to-be-signed bytes had been engineered to collide, under MD5, with a second certificate carrying basicConstraints set to CA:TRUE -- a certificate that could itself issue certificates for any website on the internet ^[18].

The math failure was a chosen-prefix MD5 collision costing about $2^{49}$ compressions, run on roughly 200 Sony PlayStation 3 consoles. To make the two certificates collide, they hid a 204-byte collision block inside a larger, roughly 427-byte span of parser-irrelevant data in the certificate's "Netscape Comment" extension, nicknaming that meaningless span a "tumor" ^[18]. But that was only half the demonstration. The other half: RapidSSL was still issuing MD5-signed certificates in 2008, four years after Wang, with predictable serial numbers and timestamps that let the team pre-compute the colliding prefix. Both failures, side by side, in one clean demo.

sequenceDiagram
participant Atk as Attacker
participant CA as MD5-signing CA
participant Vic as Relying party
Atk->>Atk: Craft two colliding prefixes, one benign and one a forged CA
Atk->>CA: Request a certificate for the benign prefix
CA->>Atk: Return an MD5-signed end-entity certificate
Atk->>Atk: Move the signature onto the forged CA certificate
Atk->>Vic: Present the forged certificate chain
Vic->>Vic: Recompute MD5, the digests match, trust is granted

2012: Flame, and an attacker ahead of academia#

Return to the malware from the opening. When Marc Stevens examined the fraudulent certificate Flame carried, he found something that should not exist. Using a technique he called counter-cryptanalysis, he reconstructed the collision and proved the operators used a chosen-prefix MD5 variant not yet in the open cryptographic literature ^[3]; Max Fillinger and Stevens later fully reverse-engineered it ^[19]. The conclusion was as unsettling as Flame. A classified actor had been ahead of academia, and spent its secret capability on one target: a Microsoft licensing certificate the Enforced Licensing PKI still MD5-signed ^[4], then rode into Windows Update ^[1]. Marc Stevens defended his PhD thesis, "Attacks on Hash Functions and Applications," on 19 June 2012 -- sixteen days after Microsoft's Flame advisory, and just before he would reverse-engineer the very attack Flame used ^[20].

2017: SHATTERED#

In February 2017, CWI Amsterdam and Google announced the first full SHA-1 collision: two PDFs sharing 38762cf7f55934b34d179ae6a4c80cadccbb7f0a ^[5]. The compute bill was enormous -- roughly nine quintillion SHA-1 computations, about $2^{63.1}$ operations, measured as approximately 6,500 CPU-years plus 110 GPU-years across Google's infrastructure. Both SHATTERED PDFs remain downloadable, and both still hash to 38762cf7.... You can verify the collision yourself with any SHA-1 tool ^[5]. But SHATTERED was an identical-prefix collision. It broke SHA-1 for content addressing and piled pressure on Git and Subversion, whose object identifiers are SHA-1 digests -- yet it could not, by itself, forge a certificate for a chosen identity. It proved SHA-1 dead as a collision-resistant hash without demonstrating impersonation. That final rung waited three more years.

2020: Shambles#

In January 2020, Gaetan Leurent and Thomas Peyrin delivered the chosen-prefix SHA-1 collision and named it Shambles ^[16]. They drove the cost down to about $2^{63.4}$, ran it on roughly 900 Nvidia GTX 1060 GPUs for under 100,000 US dollars, and used it to forge a PGP/GnuPG identity certification -- a Web-of-Trust signature transferable onto a forged key bearing someone else's name ^[22]. It carried CVE-2019-14855. The second failure was textbook: GnuPG 1.4 still defaulted to SHA-1 for identity certification. The fix, GnuPG 2.2.18, rejects SHA-1 identity signatures made after 19 January 2019.

"All attacks that are practical on MD5 are now also practical on SHA-1." -- Gaetan Leurent and Thomas Peyrin, SHA-1 is a Shambles, 2020 ^[16]

Four breaks, one shape#

Lay the four incidents in a row and the pattern is impossible to miss. Every single one required both a fallen primitive and a live deployment that had not stopped trusting it.

Every breach needed two failures at once: a fallen primitive AND a deprecated-but-still-live deployment. RapidSSL in 2008, Microsoft's licensing PKI in 2012, GnuPG 1.4 in 2020 -- in each case the cryptanalysis was necessary, and in each case it was the still-trusting system that turned a lab result into a compromise. This is how the honest exception stays true to the series: the math genuinely fell, and it still was not enough on its own.

Four undisputed, reproducible breaks over twelve years is not an anecdote. It is a base rate. So what did the industry build to answer it?

6. The Fix, and the Base Rate It Earns#

The four breaks were evidence for a bill the entire internet had to pay: migrate off the broken hashes, and build successors that would not fall the same way. Two answers emerged, and they are architecturally different on purpose.

The first is SHA-2, standardized in 2002 and consolidated in FIPS 180-4 ^[23]. SHA-2 keeps the Merkle-Damgard skeleton, but it does two things its predecessors did not. Its most common form, SHA-256, produces a 256-bit digest, lifting the collision ceiling from SHA-1's $2^{80}$ to a comfortable $2^{128}$. And its message schedule is strongly non-linear, which denies the Wang-style differential trails that steered small differences through MD5 and SHA-1 to cancel. The same construction, but hardened against the exact technique that broke the family.

The second answer is SHA-3, standardized as FIPS 202 in 2015 ^[24]. SHA-3 is not a patched Merkle-Damgard hash at all. It is Keccak, a structurally different sponge construction, and NIST was explicit that it arrived as a supplement to SHA-2, not a replacement. That word choice matters, and Section 7 is about why keeping two unlike designs alive is a deliberate strategy rather than indecision.

Retiring a primitive is a deployment problem#

Designing a successor is the easy half. The hard half is retiring a primitive that billions of systems already trust, and that history is a deployment history, written by standards bodies rather than cryptographers.

The engineering band-aid that bought a decade#

Standards move slowly, and in 2017 the world still ran on SHA-1 in a thousand places that could not be changed overnight -- Git chief among them. So Marc Stevens and Dan Shumow built something clever: a hardened SHA-1 that detects when it is being attacked ^[27].

Their sha1dc library computes SHA-1 normally, but watches for the fingerprints of a collision attack in progress. It detects any cryptanalytic collision attack using any of the top 32 SHA-1 disturbance vectors with probability 1, at a false-positive probability below $2^{-90}$, for less than twice the cost of plain SHA-1. In its "safe-hash" mode it perturbs the output for a detected attack, so a colliding input no longer produces the colliding digest the attacker engineered. GitHub and Git integrated it directly, which is why pushing the SHATTERED PDFs to GitHub is rejected rather than silently accepted.

Step back and look at what this whole apparatus is. SHA-2, SHA-3, the SP 800-131A timeline, the 2030 retirement, and sha1dc are not five unrelated engineering decisions. They are the industry's collective response to a measured base rate: four weaponized breaks in twelve years, on two primitives, both of which climbed the same capability ladder to the same fatal rung. The migration to SHA-2 and SHA-3 is not caution in the abstract. It is a bill the evidence already justified.

But that raises a question the newer standard makes unavoidable. If SHA-3 is the more modern design, why did NIST tell everyone they did not need to switch to it?

7. Diversification, Not Supersession#

Intuition says the newer standard should replace the older one. It says SHA-3, arriving in 2015, should retire SHA-2 the way SHA-2 retired SHA-1. NIST says the opposite: there is "no need to transition applications from SHA-2 to SHA-3" ^[28]. To see why that is not laziness, you have to notice that two different things have been happening at once, on two different axes.

One axis is supersession: MD5 gave way to SHA-1 gave way to SHA-2, each replacing a predecessor whose collision resistance had fallen. The other axis is diversification: SHA-2 and SHA-3 are kept alive together, deliberately, because they fail differently. FIPS 202 calls SHA-3 a "supplement" for exactly this reason ^[24]. If a structural attack ever lands on the Merkle-Damgard family, SHA-3's sponge is a ready backup that does not share the same skeleton -- and vice versa. You do not keep a spare tire because the current one is flat. You keep it because someday it might be.

The wart SHA-2 still carries#

The clearest reason to hold a structurally different backup is a flaw SHA-2 inherited from the whole Merkle-Damgard family, one that is not a collision attack at all.

This is why H(secret || message) is a broken message-authentication code: an attacker who sees one valid tag can append data and forge a new valid tag without knowing the secret. It is the specific reason HMAC was designed, and the specific reason cryptographers wrap secrets rather than concatenating them.

flowchart LR
subgraph MD["Merkle-Damgard, SHA-2"]
A["Message blocks"] --> B["Compress over a fixed IV"]
B --> C["Final state is the whole digest"]
end
subgraph SP["Sponge, SHA-3"]
D["Absorb blocks into a wide state"] --> E["Permutation Keccak-f"]
E --> F["Squeeze the digest, hidden capacity retained"]
end

SHA-3's sponge absorbs input into a wide internal state but squeezes out only part of it, keeping a hidden capacity the attacker never sees. That single design choice makes SHA-3 immune to length extension -- the exact Merkle-Damgard wart SHA-2 still carries ^[24]. Diversification is not sentiment; it is holding one primitive that is missing a specific weakness of the other.

The wider field#

Beyond the two NIST standards sit fast, non-NIST alternatives worth naming, though their internals belong to a dedicated hash field guide. BLAKE2 and BLAKE3 are fast, length-extension-immune designs; BLAKE3 is built as an internal Merkle tree and markets itself as much faster than MD5, SHA-1, SHA-2, SHA-3, and BLAKE2 while being "secure against length extension, unlike SHA-2" ^{[29, 30]}. KangarooTwelve is a Keccak-based extendable-output function tuned for raw speed ^[31]. None of these is a migration requirement; they are options where speed matters more than a FIPS stamp.

So the successors are safe, and the boundary between them is clear. Does that mean MD5 and SHA-1 are simply "broken," full stop? Both halves of that sentence are more subtle than they sound.

8. What "Broken" Actually Means#

"MD5 and SHA-1 are broken" is one of the most repeated sentences in security, and one of the most imprecise. Broken for what? The honest answer is both narrower and deeper than the slogan, and getting it right is the difference between a competent migration and a superstitious one.

Start with the ceiling. The birthday bound is not merely the best attack anyone has found; by an elementary counting argument in the black-box model, no collision search on an n-bit hash can do better than about $2^{n/2}$. That is a proven floor on the work, so when we say a hash "fell," we mean an attack got below even that reduced barrier -- SHA-1's collisions cost roughly $2^{63}$ against a $2^{80}$ bound. The bound held as a concept; the specific functions failed to meet it.

Now the narrowing. Defeating collision resistance says nothing about the other two promises. MD5 and SHA-1 preimage resistance remains largely intact: you still cannot, in practice, take a SHA-1 digest and find any message that produces it, because that attack costs the full $2^{160}$ ^[28]. Every collision in this article had the attacker choosing both sides. None of them inverted a hash. So a password stored as a salted SHA-1 hash is weak for many reasons, but not because SHA-1 collided.

The HMAC carve-out is a theorem#

The sharpest example of scoping is HMAC, and it is worth stating precisely because it is so often waved away as folklore.

That single carve-out rescues an enormous amount of deployed infrastructure, and it is why blanket advice to "purge every SHA-1 from the network" is wrong. The keyed uses stand on ground the collision attacks never touched.

How much margin do the successors have?#

If the predecessors fell far below their bounds, how close is SHA-2 to its own cliff? Not close. The best public collision results against SHA-256 are all heavily round-reduced: the strongest practical result is a 39-step semi-free-start collision, which improved a 38-step result from 2013, against SHA-256's full 64 steps ^[34]. A semi-free-start attack even grants the attacker extra freedom over the initial value that a real deployment never allows. In other words, nobody has a practical collision on anything close to full-round SHA-256, from a fixed IV or otherwise. The successor sits comfortably at its theoretical ceiling.

Quantum honesty#

Does quantum computing change the verdict? Less than headlines imply. Grover's algorithm speeds up preimage search quadratically, which merely halves the exponent: a quantum attacker brings SHA-256 preimage resistance from $2^{256}$ down to about $2^{128}$, which is still infeasible ^[35]. For collisions, the picture is worse for the attacker than the naive story suggests -- once you honestly account for the memory and hardware cost of the quantum collision algorithms, there is no clean quadratic win over classical collision search ^[36]. Quantum does not move a well-sized hash from safe to broken.

"Broken" is scoped. Collision resistance fell; preimage resistance and HMAC-SHA-1 did not. The problem is narrower than the slogan -- and, at the same time, deeper, because the entire MD family shares one construction.

And the depth is the twist. The trouble was never only that two specific functions collided. The whole Merkle-Damgard family carries structural liabilities that are features of the design, not bugs in a particular hash: length extension, and Kelsey-Schneier long-message second-preimage attacks that beat the $2^n$ ideal for very long messages ^[37]. Those are exactly why SHA-3's sponge exists and why the successors coexist by diversification. The real problem was never "swap the algorithm." It was "retire a construction's fragile clause from billions of deployments, and keep a structurally different backup alive."

Which is precisely why, years after the math was settled, this is still an open problem. The mathematics was fixed. The deployments were not.

9. The Deprecated-but-Still-Live Tail#

The math was settled years ago. The deployments were not, and the thesis's own second clause is still an open wound. Where is MD5 or SHA-1 still trusted, right now, as you read this?

Start with the most surprising answer: SHA-1 is still Git's default object format. Every commit hash in most repositories on earth is a SHA-1 digest. Git's transition to SHA-256 is real, carefully engineered, and genuinely underway -- but it is opt-in and staged, exposed through an objectFormat extension and a compatObjectFormat for interoperability, deliberately designed as a "dark launch" so users can gain the new hash without any visible change ^[38]. ※ The design lets a repository support the new hash before anyone flips the default, which is why the runway is measured in years, not months. That is the opposite of "Git migrated off SHA-1." Git added collision detection with sha1dc, then began a long, optional migration whose default is still the broken hash.

Git is only the visible tip. MD5 and SHA-1 persist in embedded firmware that will never be patched, in enterprise PKI islands, in legacy network protocols, and in deduplication systems whose keys are hashes. Each is a place where the primitive fell but the deployment kept trusting it -- the exact two-failure condition, waiting.

The cost curve keeps falling#

What makes the tail dangerous is that the price of an attack only drops. Shambles established that "all attacks that are practical on MD5 are now also practical on SHA-1," pushing a chosen-prefix SHA-1 collision to a total compute cost under 100,000 US dollars ^[16]. That number falls every year as GPUs get cheaper and the cryptanalysis sharpens. A deployment that felt safe because "nobody would spend millions on this" is on a countdown, because soon nobody will need millions.

Honest mathematical limits, too#

Not every open question is operational. A few are genuinely mathematical, and honesty requires naming them. How far can collision cryptanalysis climb past the current round-reduced records on SHA-256, whose best practical result still stops well short of full-round from a fixed IV ^[34]? How much do the structural Merkle-Damgard weaknesses -- length extension, and Kelsey-Schneier long-message second-preimages -- constrain future designs ^[37]? How far can the round-reduced frontier on SHA-3's own permutation be pushed? These are live research questions, but none of them threatens a correctly deployed SHA-2 or SHA-3 today.

The center of gravity, though, is not in a lab. It is operational: how do you retire a primitive from billions of interlocking dependencies before the next drop in attack cost reaches the ones you forgot about? That is not a question cryptography can answer. It is a question of inventory, prioritization, and follow-through -- which is exactly what a practitioner can act on. So what do you actually do on Monday morning?

10. Auditing and Migrating Today#

You can compress this entire history into a single audit question and carry it into any codebase:

That question sorts every hash use cleanly, because it asks the one thing the four breaks all had in common: an attacker who controlled both colliding messages and gained something from the collision.

Migrate these now, because they are collision-dependent: X.509 certificates, digital signatures of every kind, code signing, content-addressed storage keys such as Git and Subversion object identifiers, and any adversarial deduplication where a hash decides that two objects are "the same."

You can generally leave these, because collision resistance is not what protects them: HMAC-SHA-1 and HMAC-MD5, which rest on a pseudorandom-function assumption instead ^[33]; non-adversarial checksums that guard against accidental corruption rather than a motivated forger; and verification of already-trusted legacy data where no attacker chooses the inputs ^[28]. NIST's own guidance keeps SHA-1 available for HMAC and key derivation for exactly this reason.

function auditHashUse(use) {
const collisionDependent = [
  "certificate", "signature", "code-signing",
  "git-object", "content-address", "dedup-key"
];
const safe = ["hmac", "checksum", "legacy-verify", "kdf"];

if (collisionDependent.includes(use)) {
  return "MIGRATE -- collision-dependent, move to SHA-2 or SHA-3";
}
if (safe.includes(use)) {
  return "OK -- collision resistance is not relied on";
}
return "REVIEW -- ask: can an adversary supply both inputs and profit?";
}

["certificate", "hmac", "git-object", "checksum", "code-signing"].forEach(function (u) {
console.log(u, "->", auditHashUse(u));
});

Choosing a target#

Once you know a use must move, pick the destination by requirement, not by fashion. SHA-256 is the FIPS default and the safe first answer: NIST tells designers to implement it at a minimum, and it is hardware-accelerated on modern CPUs ^{[23, 28]}. Want length-extension resistance for free? SHA-512/256 truncates a wider computation and never leaks its full state ^[23]. Want structural diversity or an extendable-output function? Reach for SHA-3 or SHAKE ^[24].

If raw speed dominates and a FIPS stamp is not required, BLAKE3 is the fastest of the group and length-extension-immune ^[30]. And if you are stuck on a SHA-1 you cannot rip out this quarter, deploy sha1dc collision detection the way Git did, then schedule the real migration behind it ^[27].

The mistakes, mapped to the breaks#

Every common hashing mistake is a small echo of one of the four incidents. Naming the echo makes the fix obvious.

Two pitfalls deserve their own warning because they masquerade as fixes. Swapping Ethereum's Keccak-256 for standardized SHA3-256 silently changes your digests ^[24]. And treating sha1dc as a migration rather than a stopgap leaves you permanently one clever attack away from trouble; detection buys time, it does not end the dependency.

Internalize that audit question and these habits, and you have absorbed the base rate this whole history was written to establish. It remains only to name it.

11. The Base Rate#

Return to the digest from the opening: 38762cf7f55934b34d179ae6a4c80cadccbb7f0a. You can read it now. It is a SHA-1 value shared by two different PDFs -- an identical-prefix collision from SHATTERED, which means it proved SHA-1 dead for content addressing but could not, on its own, forge a certificate for a chosen identity ^[5]. That one artifact contains the whole argument in miniature: a real mathematical break, precisely scoped, whose damage depended entirely on what still trusted it.

Stretch that artifact across nearly four decades. From MD5's publication in 1992 to the federally mandated retirement of its successor SHA-1 in 2030 is a thirty-eight-year empirical record ^{[6, 26]}. Inside it sit four undisputed, reproducible, weaponized breaks -- the 2008 rogue CA, 2012's Flame, 2017's SHATTERED, 2020's Shambles. Four in twelve years, on two primitives that fell the same way, is not a scare story. It is a measured base rate, and it is the entire justification for migrating to SHA-2 and SHA-3.

Every break in this story needed two failures at once: a hash whose math had fallen, and a deployment that had not yet stopped trusting it.

That is how this article honors the series' thesis without lying about the mathematics. This is the one topic where the primitive genuinely fell -- and even here, cryptanalysis was necessary and never sufficient. RapidSSL had to still be signing with MD5. Microsoft's licensing PKI had to still be signing with MD5. GnuPG had to still default to SHA-1. The math was the loaded chamber; the still-live deployment pulled the trigger.

And keep the boundary honest, because the slogan overreaches in both directions. "Broken" is scoped to collision-dependent uses: HMAC-SHA-1 survives on a proof, and preimage resistance held ^{[33, 28]}. The successors do not stand in a line of succession at all -- SHA-2 and SHA-3 coexist by diversification, one construction covering the other's structural blind spot.

For the mechanisms of how the successors themselves could someday be attacked -- Merkle-Damgard collisions, length extension, and the sponge's algebraic frontier -- see the structural sibling to this piece, How SHA-2 and SHA-3 Would Break, along with the series' dedicated hash and X.509/PKI field guides. The migration itself is not a debate. It is an argument the evidence already won. The only open question left is how fast the still-live tail catches up before the next drop in attack cost reaches the systems that forgot to.

12. Frequently Asked Questions#