First collision for 70-step SHA-1

Graz, January 2007: Researchers of the Krypto group of the IAIK succeeded in constructing a collision for a simplified variant of the standard hash function SHA-1. The simplified variant differs from the standard only in the number of iterations of the step functions that is used: 70 instead of 80

This research project is sponsored in part by the Austrian Science Fund (FWF) under project number P18138, and in part by the Secure Information Technology Center - Austria (A-SIT).

A technical article describing the used technique is being prepared. The research is continued in order to be able to produce collisions for the full 80-step standard.

Details of a collision for SHA-1 reduced to 70 steps: The 1024-bit messages (M1,M2) and (M1*,M2*) both produce the value H for the chaining variable. Adding the padding and/or further common blocks changes the hash output, but not the fact that there is a collision.

    M1       M1*   
3bb33aae abb33ade
85aecbbb 35aecbe8
57a88417 67a8841f
8137cb9c 8137cbdf
4de99220 9de99252
5b6f12c7 eb6f12d7
726bd948 826bd92a
e3f6e9b8 23f6e9fa
23607799 236077a9
239b2f1d c39b2f5f
aac76b94 8ac76bf4
e8009a1e 08009a5f
c24de871 e24de821
5b7c30d8 9b7c3099
000359f5 e0035987
90f9ed31 30f9ed32

    M2       M2*     
abddbee2 3bddbe92
42a20ac7 f2a20a94
a915e04d 9915e045
5063b027 5063b064
4ddf989a 9ddf98e8
e0020cf7 50020ce7
7ffdc0f4 8ffdc096
efefe0a7 2fefe0e5
0ffbc2f0 0ffbc2c0
c8de16bf 28de16fd
81bbe675 a1bbe615
254429cb c544298a
5f37a2c6 7f37a296
cd1963d3 0d196392
ffca1cb9 1fca1ccb
9642cb56 3642cb55

    H   
151866d5
f7940d84
28e73685
c4d97e18
97da712b