On February 23, 2017, researchers at Google and CWI Amsterdam put two PDF files on a website. The files were visibly different — you could open them side by side and see different content — and they had the same SHA-1 hash. You could download both from shattered.io and run sha1sum yourself. Same 40 hex characters. Two different documents.
That’s what a hash collision looks like when it stops being a proof on a whiteboard and becomes a file you can hold. And the thing worth sitting with isn’t that it finally happened. It’s that the entire security industry had been told this was coming since 2005, watched the estimated cost fall year after year, and still treated February 23, 2017 as the day the news arrived.
What a collision actually breaks
A cryptographic hash makes one promise that matters here: nobody can find two inputs that produce the same output. Not “it’s unlikely.” Nobody can. Every use of a hash for security leans on that — a digital signature signs the hash of a document, not the document, so if I can make a second document with the same hash, your signature on the first is now a valid signature on mine. A certificate authority signs the hash of a certificate. Git names every commit by the hash of its contents. Break “you can’t find two inputs with the same output” and all of those inherit the crack.
SHA-1 outputs 160 bits. Brute force — the birthday attack — should take about 2⁸⁰ operations to find any collision, which was comfortably out of reach when SHA-1 shipped in 1995. The problem is that SHA-1’s internal structure has weaknesses that let you do far better than brute force, and in 2005 Xiaoyun Wang and colleagues published an attack that cut the cost to roughly 2⁶⁹. That’s about 2,000 times cheaper than brute force. No one ran it — it was still enormous — but the number was published, and from that moment SHA-1 was a hash with a known crack and a falling price tag. Everyone competent knew the collision was a matter of budget and time.
The twelve-year wait
Here is the part that should bother you. NIST formally deprecated SHA-1 in 2011 and disallowed it for digital signatures in 2013. The CA/Browser Forum ruled that certificate authorities had to stop issuing SHA-1 certificates after January 1, 2016 and browsers would stop trusting them a year later. All of that happened before anyone demonstrated a real collision — the deadlines were set on the theory alone, which is exactly how it should work. And a huge amount of the internet dragged its feet anyway, right up against the deadline, because “theoretically broken” doesn’t feel like a reason to do painful migration work. It feels like an academic footnote until someone posts the file.
Someone posted the file. SHAttered took roughly nine quintillion SHA-1 computations — about 6,500 CPU-years for the first phase and 110 GPU-years for the second, run in parallel on Google’s fleet so the wall-clock time was months, not centuries. Around a hundred thousand times cheaper than brute force, which is the whole point: the “2⁸⁰” that made SHA-1 look safe was never the real number. The real number had been shrinking in the literature for a decade, and 2017 was just the year it dropped below “a large company can afford this as a demo.”
The collision that was actually dangerous came later
SHAttered gets the fame, but it was a limited weapon. It produced an identical-prefix collision: the two files had to share the same leading bytes, and the researchers controlled the colliding blocks in the middle of both. That’s enough to make two PDFs that render differently, and it’s a genuine break, but weaponizing it against a real target is awkward because the attacker has to construct both halves of the collision.
The one to worry about arrived in January 2020, when Gaëtan Leurent and Thomas Peyrin published “SHA-1 is a Shambles” — the first practical chosen-prefix collision. Chosen-prefix means the attacker picks two arbitrary, different beginnings — say, two different identities — and the math finds colliding blocks to append to each. That’s the shape of attack that forges real things. They demonstrated it by impersonating a victim in the PGP web of trust: a signature made over one person’s key becomes a valid signature over another’s. The cost was about $45,000 in rented GPU time, “within the means of academic researchers,” on hardware anyone can rent. Three years after SHAttered, the dangerous version of the attack cost less than a used car.
So the migration deadlines that felt so aggressive in 2015 look, in hindsight, exactly right — and the foot-dragging looks exactly as reckless as the cryptographers were saying it was.
Why Git didn’t fall over
The obvious objection: Git names everything by SHA-1, and Git did not collapse in 2017. Why not?
Because Git wasn’t using SHA-1 as a signature over adversarial input — it was using it as a content address in a system where, mostly, you already trust whoever is handing you commits. A collision matters when an attacker can substitute one blessed object for a malicious twin. Git’s exposure is real but narrower than a CA’s, and the project bought itself room two ways. First, Marc Stevens — one of the SHAttered authors — had built a collision detector: a function that hashes normally but recognizes the tell-tale internal state of the known attack techniques and refuses the input. Git and GitHub deployed that hardened SHA-1 (SHA-1DC) so that the exact class of colliding blocks SHAttered produced gets rejected on sight. Second, Git has been slowly building a path to SHA-256. The detector is a patch on a sinking boat; it buys time, it isn’t the fix. But it’s a good illustration that “SHA-1 is broken” isn’t one fact — it depends entirely on whether your threat model includes an attacker who gets to choose the input.
The real lesson isn’t about SHA-1
Every deprecated primitive follows this curve. There’s a moment when the academic literature makes the break predictable, and a much later moment when someone publishes a proof of concept you can download. All the actual risk lives in the gap between them — because that’s the window where the thing is exploitable-in-principle, everyone with a budget knows it, and most operators are still waiting for the PoC before they’ll spend a sprint on migration. We ran the entire SHA-1 story that way, and we are running the same play right now with the primitives that quantum computers are expected to break: the theory is in, the deadline is set, and most of the internet is waiting to see the file before it moves.
The uncomfortable thing SHAttered proved isn’t that SHA-1 was weak. Everyone knew SHA-1 was weak. It’s that “everyone knows it’s weak” and “everyone acts like it’s weak” are separated by years, and the separator is a demo — not the discovery, the demo. The cryptographers were right in 2005. The industry believed them in 2017. Twelve years is a long time to be exploitable while waiting to be convinced.