SHA1 collision demo / example

Question

This question is similar to this, but that one only references MD5 collision demos.

Are there any actual SHA1 collision pairs of arbitrary messages known so far ?

Answer 1

As of February 23rd 2017 this answer is no longer accurate.

For more than six years, the SHA1 cryptographic hash function underpinning Internet security has been at death's door. Now it's officially dead, thanks to the submission of the first known instance of a fatal exploit known as a "collision."

There is no known collision for SHA-1 yet. Right now:

• There are some collisions on reduced versions of SHA-1, with less than the 80 rounds of the standard SHA-1.
• An algorithm has been describe, which should obtain a SHA-1 collision with a computational effort roughly equivalent to 2⁶³ invocations of SHA-1 on small messages; that's much better than generic algorithms (which require 2⁸⁰ invocations on average) but that's still quite big and that algorithm has not been run yet.

There was an effort to obtain a SHA-1 collision by harnessing power from whoever had some spare CPU clock cycles to donate, with the BOINC framework to organize the whole thing, but there were not enough volunteers and the effort was abandoned last year. Hence no actual SHA-1 collision yet.

Theoretical attacks rely on some assumptions which may prove to be slightly false; for instance, the attack on MD5 is actually a bit faster than expected (at some point there is a property which must be fulfilled, with a theoretical probability of 2^-28, but in practice it is more like 2^-27.7, i.e. the attack is 20% faster than predicted). It is still considered that the theoretical attack is correct and the complexity "rather accurate".