Hash function security summary


This article summarizes publicly known attacks against cryptographic hash functions. Note that not all entries may be up to date. For a summary of other hash function parameters, see comparison of cryptographic hash functions.

Table color key

Common hash functions

Collision resistance

Hash functionSecurity claimBest attackPublish dateComment
MD5264218 time2013-03-25This attack takes seconds on a regular PC. Two-block collisions in 218, single-block collisions in 241.
SHA-1280261.22020-01-08Paper by Gaëtan Leurent and Thomas Peyrin
SHA256212831 of 64 rounds 2013-05-28Two-block collision.
SHA512225624 of 80 rounds 2008-11-25Paper.
SHA-3Up to 25126 of 24 rounds 2017Paper.
BLAKE2s21282.5 of 10 rounds 2009-05-26Paper.
BLAKE2b22562.5 of 12 rounds 2009-05-26Paper.

Chosen prefix collision attack

Hash functionSecurity claimBest attackPublish dateComment
MD52642392009-06-16This attack takes hours on a regular PC.
SHA-1280263.42020-01-08Paper by Gaëtan Leurent and Thomas Peyrin
SHA2562128
SHA5122256
SHA-3Up to 2512
BLAKE2s2128
BLAKE2b2256

Preimage resistance

Hash functionSecurity claimBest attackPublish dateComment
MD521282123.42009-04-27Paper.
SHA-1216045 of 80 rounds2008-08-17Paper.
SHA256225643 of 64 rounds 2009-12-10Paper.
SHA512251246 of 80 rounds 2008-11-25Paper, updated version.
SHA-3Up to 2512
BLAKE2s22562.5 of 10 rounds 2009-05-26Paper.
BLAKE2b22562.5 of 12 rounds 2009-05-26Paper.

Less-common hash functions

Collision resistance

Hash functionSecurity claimBest attackPublish dateComment
GOST212821052008-08-18Paper.
HAVAL-128264272004-08-17Collisions originally reported in 2004, followed up by cryptanalysis paper in 2005.
MD22642009Slightly less computationally expensive than a birthday attack, but for practical purposes, memory requirements make it more expensive.
MD42643 operations2007-03-22Finding collisions almost as fast as verifying them.
PANAMA2128262007-04-04Paper, improvement of an earlier theoretical attack from 2001.
RIPEMD 264218 time2004-08-17Collisions originally reported in 2004, followed up by cryptanalysis paper in 2005.
RadioGatúnUp to 260827042008-12-04For a word size w between 1-64 bits, the hash provides a security claim of 29.5w. The attack can find a collision in 211w time.
RIPEMD-16028048 of 80 rounds 2006Paper.
SHA-0280233.6 time2008-02-11Two-block collisions using boomerang attack. Attack takes estimated 1 hour on an average PC.
Streebog22569.5 rounds of 12 2013-09-10Rebound attack.
Whirlpool22564.5 of 10 rounds 2009-02-24Rebound attack.

Preimage resistance

Hash functionSecurity claimBest attackPublish dateComment
GOST225621922008-08-18Paper.
MD22128273 time, 273 memory2008Paper.
MD421282102 time, 233 memory2008-02-10Paper.
RIPEMD 212835 of 48 rounds2011Paper.
RIPEMD-128212835 of 64 rounds2011Paper.
RIPEMD-160216031 of 80 rounds2011Paper.
Streebog25122266 time, 2259 data2014-08-29The paper presents two second-preimage attacks with variable data requirements.
Tiger21922188.8 time, 28 memory2010-12-06Paper.