Hash function security summary

This article summarizes publicly known attacks against cryptographic hash functions. Note that not all entries may be up to date. For a summary of other hash function parameters, see comparison of cryptographic hash functions.

Table color key

Hash function	Security claim	Best attack	Publish date	Comment
MD5	2⁶⁴	2¹⁸ time	2013-03-25	This attack takes seconds on a regular PC. Two-block collisions in 2¹⁸, single-block collisions in 2⁴¹.
SHA-1	2⁸⁰	2^63.1	2017-02-23	Paper.
SHA256	2¹²⁸	31 of 64 rounds (2^65.5)	2013-05-28	Two-block collision.
SHA512	2²⁵⁶	24 of 80 rounds (2^32.5)	2008-11-25	Paper.
BLAKE2s	2¹²⁸	2.5 of 10 rounds (2¹¹²)	2009-05-26	Paper.
BLAKE2b	2²⁵⁶	2.5 of 12 rounds (2²²⁴)	2009-05-26	Paper.
SHA-1	2⁸⁰	2^77.1	2012-06-19	Paper.
SHA256	2¹²⁸
SHA512	2²⁵⁶
BLAKE2s	2¹²⁸
BLAKE2b	2²⁵⁶

Hash function	Security claim	Best attack	Publish date	Comment
MD5	2¹²⁸	2^123.4	2009-04-27	Paper.
SHA-1	2¹⁶⁰	45 of 80 rounds	2008-08-17	Paper.
SHA256	2²⁵⁶	43 of 64 rounds (2^254.9 time, 2⁶ memory)	2009-12-10	Paper.
SHA512	2⁵¹²	46 of 80 rounds (2^511.5 time, 2⁶ memory)	2008-11-25	Paper, updated version.
HAVAL-128	2⁶⁴	2⁷	2004-08-17	Collisions originally reported in 2004, followed up by cryptanalysis paper in 2005.
MD2	2⁶⁴		2009	Slightly less computationally expensive than a birthday attack, but for practical purposes, memory requirements make it more expensive.
MD4	2⁶⁴	3 operations	2007-03-22	Finding collisions almost as fast as verifying them.
PANAMA	2¹²⁸	2⁶	2007-04-04	Paper, improvement of an earlier theoretical attack from 2001.
RIPEMD (original)	2⁶⁴	2¹⁸ time	2004-08-17	Collisions originally reported in 2004,
RadioGatún	2⁶⁰⁸ *	2⁷⁰⁴	2008-12-04	For a word size w between 1-64 bits, the hash provides a collision security claim of 2^8.5w. For any value, the attack can find a collision in 2^11w time.
RIPEMD-160	2⁸⁰	48 of 80 rounds (2⁵¹ time)	2006	Paper.
SHA-0	2⁸⁰	2^33.6 time	2008-02-11	Two-block collisions using boomerang attack. Attack takes estimated 1 hour on an average PC.
Streebog	2²⁵⁶	9.5 rounds of 12 (2¹⁷⁶ time, 2¹²⁸ memory)	2013-09-10	Rebound attack.
Whirlpool	2²⁵⁶	4.5 of 10 rounds (2¹²⁰ time)	2009-02-24	Rebound attack.

Hash function	Security claim	Best attack	Publish date	Comment
GOST	2²⁵⁶	2¹⁹²	2008-08-18	Paper.
MD4	2¹²⁸	2¹⁰² time, 2³³ memory	2008-02-10	Paper.
RIPEMD (original)	2¹²⁸	35 of 48 rounds	2011	Paper.
RIPEMD-128	2¹²⁸	35 of 64 rounds
RIPEMD-160	2¹⁶⁰	31 of 80 rounds
Streebog	2⁵¹²	2²⁶⁶ time, 2²⁵⁹ data	2014-08-29	The paper presents two second-preimage attacks with variable data requirements.
Tiger	2¹⁹²	2^188.8 time, 2⁸ memory	2010-12-06	Paper.