SHA1 now == insecure

[Monedeath]

For those that have missed the news over the past few days:

https://arstechnica.com/security/201...n-is-now-dead/

Now, researchers have demonstrated a similar type of real-world attack against SHA1, which ironically was widely adopted after the insecurity of MD5 became well-known. The SHA1 collision is documented in a research paper published Thursday. It presents two PDF files that, despite displaying different content, have the same SHA1 hash. The researchers warned that the same technique—which costs as little as $110,000 to carry out on Amazon's cloud computing platform—could be used to create collisions in GIT file objects or digital certificates.

[reggie14]

SHA-1 was insecure a decade ago. We just have an example of it now.

The ~$100k cost is in-line with the projections that have been around for awhile now.

In other words, this wasn't a big surprise.