Hash function security summary explained

This article summarizes publicly known attacks against cryptographic hash functions. Note that not all entries may be up to date. For a summary of other hash function parameters, see comparison of cryptographic hash functions.

Table color key

See also: Security level.

Common hash functions

Collision resistance

See main article: Collision attack.

Hash function	Security claim	Best attack	Publish date	Comment
MD5	2^64	2^18 time	2013-03-25	This attack takes seconds on a regular PC. Two-block collisions in 2^18, single-block collisions in 2^41.^[1]
SHA-1	2^80	2^61.2	2020-01-08	Paper by Gaëtan Leurent and Thomas Peyrin^[2]
SHA256	2^128	31 of 64 rounds (2^65.5)	2013-05-28	Two-block collision.^[3]
SHA512	2^256	24 of 80 rounds (2^32.5)	2008-11-25	Paper.^[4]
SHA-3	Up to 2^512	6 of 24 rounds (2^50)	2017	Paper.^[5]
BLAKE2s	2^128	2.5 of 10 rounds (2^112)	2009-05-26	Paper.^[6]
BLAKE2b	2^256	2.5 of 12 rounds (2^224)	2009-05-26	Paper.

Chosen prefix collision attack

Hash function	Security claim	Best attack	Publish date	Comment
MD5	2^64	2^39	2009-06-16	This attack takes hours on a regular PC.^[7]
SHA-1	2^80	2^63.4	2020-01-08	Paper by Gaëtan Leurent and Thomas Peyrin^[8]
SHA256	2^128
SHA512	2^256
SHA-3	Up to 2^512
BLAKE2s	2^128
BLAKE2b	2^256

Preimage resistance

See main article: Preimage attack.

Hash function	Security claim	Best attack	Publish date	Comment
MD5	2^128	2^123.4	2009-04-27	Paper.^[9]
SHA-1	2^160	45 of 80 rounds	2008-08-17	Paper.^[10]
SHA256	2^256	43 of 64 rounds (2^254.9 time, 2^6 memory)	2009-12-10	Paper.^[11]
SHA512	2^512	46 of 80 rounds (2^511.5 time, 2^6 memory)	2008-11-25	Paper,^[12] updated version.
SHA-3	Up to 2^512
BLAKE2s	2^256	2.5 of 10 rounds (2^241)	2009-05-26	Paper.
BLAKE2b	2^512	2.5 of 12 rounds (2^481)	2009-05-26	Paper.

Length extension

See main article: Length extension attack.

• Vulnerable: MD5, SHA1, SHA256, SHA512
• Not vulnerable: SHA384, SHA-3, BLAKE2

Less-common hash functions

Collision resistance

Hash function	Security claim	Best attack	Publish date	Comment
GOST	2^128	2^105	2008-08-18	Paper.^[13]
HAVAL-128	2^64	2^7	2004-08-17	Collisions originally reported in 2004,^[14] followed up by cryptanalysis paper in 2005.^[15]
MD2	2^64		2009	Slightly less computationally expensive than a birthday attack,^[16] but for practical purposes, memory requirements make it more expensive.
MD4	2^64	3 operations	2007-03-22	Finding collisions almost as fast as verifying them.^[17]
PANAMA	2^128	2^6	2007-04-04	Paper,^[18] improvement of an earlier theoretical attack from 2001.^[19]
RIPEMD (original)	2^64	2^18 time	2004-08-17	Collisions originally reported in 2004, followed up by cryptanalysis paper in 2005.^[20]
RadioGatún	Up to 2^608^[21]	2^704	2008-12-04	For a word size w between 1-64 bits, the hash provides a security claim of 2^9.5w. The attack can find a collision in 2^11w time.^[22]
RIPEMD-160	2^80	48 of 80 rounds (2^51 time)	2006	Paper.^[23]
SHA-0	2^80	2^33.6 time	2008-02-11	Two-block collisions using boomerang attack. Attack takes estimated 1 hour on an average PC.^[24]
Streebog	2^256	9.5 rounds of 12 (2^176 time, 2^128 memory)	2013-09-10	Rebound attack.^[25]
Whirlpool	2^256	4.5 of 10 rounds (2^120 time)	2009-02-24	Rebound attack.^[26]

Preimage resistance

Hash function	Security claim	Best attack	Publish date	Comment
GOST	2^256	2^192	2008-08-18	Paper.
MD2	2^128	2^73 time, 2^73 memory	2008	Paper.^[27]
MD4	2^128	2^102 time, 2^33 memory	2008-02-10	Paper.^[28]
RIPEMD (original)	2^128	35 of 48 rounds	2011	Paper.^[29]
RIPEMD-128	2^128	35 of 64 rounds
RIPEMD-160	2^160	31 of 80 rounds
Streebog	2^512	2^266 time, 2^259 data	2014-08-29	The paper presents two second-preimage attacks with variable data requirements.^[30]
Tiger	2^192	2^188.8 time, 2^8 memory	2010-12-06	Paper.^[31]

Attacks on hashed passwords

See main article: Password cracking. Hashes described here are designed for fast computation and have roughly similar speeds.^[32] Because most users typically choose short passwords formed in predictable ways, passwords can often be recovered from their hashed value if a fast hash is used. Searches on the order of 100 billion tests per second are possible with high-end graphics processors.^{[33] [34]} Special hashes called key derivation functions have been created to slow brute force searches. These include pbkdf2, bcrypt, scrypt, argon2, and balloon.

See also

• Comparison of cryptographic hash functions
• Cryptographic hash function
• Collision attack
• Preimage attack
• Length extension attack
• Cipher security summary

External links

• 2010 summary of attacks against Tiger, MD4 and SHA-2: Jian Guo . San Ling . Christian Rechberger . Huaxiong Wang . 2010-12-06 . Advanced Meet-in-the-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2 . Asiacrypt 2010 . 3 .

Notes and References

1. Tao Xie . Fanbao Liu . Dengguo Feng . 25 March 2013 . Fast Collision Attack on MD5 .
2. Gaëtan Leurent . Thomas Peyrin . 2020-01-08 . SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust .
3. Florian Mendel . Tomislav Nad . Martin Schläffer . 2013-05-28 . Improving Local Collisions: New Attacks on Reduced SHA-256 . Eurocrypt 2013 .
4. Somitra Kumar Sanadhya . Palash Sarkar . 2008-11-25 . New Collision Attacks against Up to 24-Step SHA-2 . Indocrypt 2008 . 10.1007/978-3-540-89754-5_8 .
5. L. Song, G. Liao and J. Guo, Non-Full Sbox Linearization: Applications to Collision Attacks on Round-Reduced Keccak, CRYPTO, 2017
6. LI Ji . XU Liangyu . 2009-05-26 . Attacks on Round-Reduced BLAKE .
7. Marc Stevens . Arjen Lenstra . Benne de Weger . 2009-06-16 . Chosen-prefix Collisions for MD5 and Applications .
8. Gaëtan Leurent . Thomas Peyrin . 2020-01-08 . SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust .
9. Yu Sasaki . Kazumaro Aoki . 2009-04-27 . Finding Preimages in Full MD5 Faster Than Exhaustive Search . Eurocrypt 2009 . 10.1007/978-3-642-01001-9_8 . free .
10. Christophe De Cannière . Christian Rechberger . 2008-08-17 . Preimages for Reduced SHA-0 and SHA-1 . Crypto 2008 .
11. Kazumaro Aoki . Jian Guo . Krystian Matusiewicz . Yu Sasaki . Lei Wang . 2009-12-10 . Preimages for Step-Reduced SHA-2 . Asiacrypt 2009 . 10.1007/978-3-642-10366-7_34 . free .
12. Yu Sasaki . Lei Wang . Kazumaro Aoki . 2008-11-25 . Preimage Attacks on 41-Step SHA-256 and 46-Step SHA-512 .
13. Florian Mendel . Norbert Pramstaller . Christian Rechberger . Marcin Kontak . Janusz Szmidt . 2008-08-18 . Cryptanalysis of the GOST Hash Function . Crypto 2008 .
14. Xiaoyun Wang . Dengguo Feng . Xuejia Lai . Hongbo Yu . 2004-08-17 . Collisions for Hash Functions MD4, MD5, HAVAL-128 and RIPEMD . Cryptology ePrint Archive .
15. Xiaoyun Wang . Dengguo Feng . Xiuyuan Yu . October 2005 . An attack on hash function HAVAL-128 . Science in China Series F: Information Sciences . 48 . 5 . 545–556 . 10.1360/122004-107 . 10.1.1.506.9546 . 2014-10-23 . https://web.archive.org/web/20170809100011/http://infosec.sdu.edu.cn/uploadfile/papers/An%20attack%20on%20hash%20function%20HAVAL-128.pdf . 2017-08-09 .
16. Lars R. Knudsen . John Erik Mathiassen . Frédéric Muller . Søren S. Thomsen . January 2010 . Cryptanalysis of MD2 . Journal of Cryptology . 23 . 1 . 72–90 . 10.1007/s00145-009-9054-1. 2443076 . free .
17. Yu Sasaki . Yusuke Naito . Noboru Kunihiro . Kazuo Ohta . 2007-03-22 . Improved Collision Attacks on MD4 and MD5 . IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences . E90-A . 1 . 36–47 . 10.1093/ietfec/e90-a.1.36 . 2007IEITF..90...36S .
18. Joan Daemen . Gilles Van Assche . 2007-04-04 . Producing Collisions for Panama, Instantaneously . FSE 2007 .
19. Vincent Rijmen . Bart Van Rompay . Bart Preneel . Joos Vandewalle . 2001 . Producing Collisions for PANAMA . FSE 2001 .
20. Xiaoyun Wang . Xuejia Lai . Dengguo Feng . Hui Chen . Xiuyuan Yu . 2005-05-23 . Cryptanalysis of the Hash Functions MD4 and RIPEMD . Eurocrypt 2005 . 10.1007/11426639_1 . free .
21. RadioGatún is a family of 64 different hash functions. The security level and best attack in the chart are for the 64-bit version. The 32-bit version of RadioGatún has a claimed security level of 2³⁰⁴ and the best claimed attack takes 2³⁵² work.
22. Thomas Fuhr . Thomas Peyrin . 2008-12-04 . Cryptanalysis of RadioGatun . FSE 2009 .
23. Florian Mendel . Norbert Pramstaller . Christian Rechberger . Vincent Rijmen . 2006 . On the Collision Resistance of RIPEMD-160 . ISC 2006 .
24. Stéphane Manuel . Thomas Peyrin . 2008-02-11 . Collisions on SHA-0 in One Hour . FSE 2008 . 10.1007/978-3-540-71039-4_2 . free .
25. Zongyue Wang . Hongbo Yu . Xiaoyun Wang . 2013-09-10 . Cryptanalysis of GOST R hash function . Information Processing Letters . 114 . 12 . 655–662 . 10.1016/j.ipl.2014.07.007.
26. Florian Mendel . Christian Rechberger . Martin Schläffer . Søren S. Thomsen . 2009-02-24 . The Rebound Attack: Cryptanalysis of Reduced Whirlpool and Grøstl . FSE 2009 .
27. Søren S. Thomsen . 2008 . An improved preimage attack on MD2 . Cryptology ePrint Archive .
28. Gaëtan Leurent . 2008-02-10 . MD4 is Not One-Way . FSE 2008 .
29. Chiaki Ohtahara . Yu Sasaki . Takeshi Shimoyama . 2011 . Preimage Attacks on Step-Reduced RIPEMD-128 and RIPEMD-160 . ISC 2011 . 10.1007/978-3-642-21518-6_13 .
30. Jian Guo . Jérémy Jean . Gaëtan Leurent . Thomas Peyrin . Lei Wang . 2014-08-29 . The Usage of Counter Revisited: Second-Preimage Attack on New Russian Standardized Hash Function . SAC 2014 .
31. Jian Guo . San Ling . Christian Rechberger . Huaxiong Wang . 2010-12-06 . Advanced Meet-in-the-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2 . Asiacrypt 2010 . 12–17 .
32. Web site: ECRYPT Benchmarking of Cryptographic Hashes. November 23, 2020.
33. Web site: Mind-blowing GPU performance. Improsec. January 3, 2020.
34. Web site: 25-GPU cluster cracks every standard Windows password in <6 hours. 2012-12-10. Dan. Goodin. Ars Technica. 2020-11-23.