Hash functions and message authentication codes

On 23 February 2017 researchers from CWI Amsterdam and Google published two different PDF files with the same SHA-1 hash. It had taken about 9.2 quintillion SHA-1 computations, roughly 6,500 CPU-years for the first phase and 110 GPU-years for the second.

SHA-1 had been a federal standard since 1995, and theoretical attacks on it had been known for years. The two PDFs turned “theoretically weak” into “anyone with enough cloud credit can forge a match”, and browsers, Git and certificate authorities finished their migrations away from it.