ALT-19 · Paper · 23 Oct 2026
SHAttered: the first SHA-1 collision
In 2017 two different PDF files with the same SHA-1 hash ended twenty years of warnings. The cost of the attack, why it took so long to retire SHA-1 anyway, and what replaced it.
- 2005Wang, Yin and Yu show SHA-1 is weaker than its design strength.
- 23 Feb 2017SHAttered: the first practical SHA-1 collision, by CWI Amsterdam and Google.
- 2020“SHA-1 is a Shambles”: a chosen-prefix collision, used to forge PGP key certifications.
- SHA-1 computations for the 2017 collision
- ~9 × 10¹⁸shattered.io
- CPU-years and GPU-years of work
- 6,500 + 110shattered.io
What a collision breaks
Signatures sign hashes. If two documents share a hash, a signature on one is a signature on the other. Git object IDs, certificate signatures and file-integrity checks all relied on SHA-1 at some point.
Why retirement takes decades
Browsers stopped trusting SHA-1 certificates around the time of the attack, but hashes are embedded everywhere: version control, firmware, document formats, old protocols. The lesson the field took was crypto-agility — designing systems so an algorithm can be swapped.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- When cryptographers say an algorithm is weakened, the clock has started.
- Collision resistance matters wherever someone else chooses the input you hash.
- Plan algorithm changes before you are forced to.
What it means for you
- Use SHA-256 or SHA-3 for anything signed or compared for integrity.
- Find SHA-1 in your stack — signatures, certificates, file checks — and plan its removal.
- Design protocols with an algorithm identifier, so the next migration is a configuration change.
Sources
Altumptic was not involved in this research. Figures are as published by the sources above.
Cite this entry
Altumptic Lab (2026). ALT-19 — SHAttered: the first SHA-1 collision. 23 Oct 2026. altumptic.com/research/shattered-sha1-2017