Editing SHA-1 (section)

====The SHAppening====
On 8 October 2015, Marc Stevens, Pierre Karpman, and Thomas Peyrin published a freestart collision attack on SHA-1's compression function that requires only 2<sup>57</sup> SHA-1 evaluations. This does not directly translate into a collision on the full SHA-1 hash function (where an attacker is ''not'' able to freely choose the initial internal state), but undermines the security claims for SHA-1. In particular, it was the first time that an attack on full SHA-1 had been ''demonstrated''; all earlier attacks were too expensive for their authors to carry them out. The authors named this significant breakthrough in the [[cryptanalysis]] of SHA-1 ''The SHAppening''.<ref name="shappening" />

The method was based on their earlier work, as well as the auxiliary paths (or boomerangs) speed-up technique from Joux and Peyrin, and using high performance/cost efficient GPU cards from [[Nvidia]]. The collision was found on a 16-node cluster with a total of 64 graphics cards. The authors estimated that a similar collision could be found by buying US$2,000 of GPU time on [[Amazon Elastic Compute Cloud|EC2]].<ref name="shappening" />

The authors estimated that the cost of renting enough of EC2 CPU/GPU time to generate a full collision for SHA-1 at the time of publication was between US$75K and $120K, and noted that was well within the budget of criminal organizations, not to mention national [[intelligence agency|intelligence agencies]]. As such, the authors recommended that SHA-1 be deprecated as quickly as possible.<ref name="shappening">{{cite web |url=https://sites.google.com/site/itstheshappening/ |title=The SHAppening: freestart collisions for SHA-1 |access-date=2015-10-09 |first1=Marc |last1=Stevens |first2=Pierre |last2=Karpman |first3=Thomas |last3=Peyrin}}</ref>