Google unveils first SHA1 collision using nine quintillion computations, releases two different PDFs with identical hashes, urges sunsetting of unsafe protocol
Posted by Marc Stevens (CWI Amsterdam), Elie Bursztein (Google), Pierre Karpman (CWI Amsterdam), Ange Albertini (Google) …
Context & Ripple Effects
This closes a chapter Google helped open years earlier: in 2015, Facebook warned that the industry's SHA-1 sunset would block millions from the encrypted web, framing deprecation as costly and disruptive. The collision announced with CWI Amsterdam — two different PDFs sharing one hash after nine quintillion computations — converts that policy debate into a demonstrated attack, removing the argument for keeping SHA-1 anywhere it authenticates content.
First-order effects
- Any system still using SHA-1 to verify document integrity or sign certificates can now be forged in principle, since Google has published working colliding PDFs rather than a theoretical result.
- Operators who delayed migration on cost grounds lose their buffer: the research team explicitly urges sunsetting the protocol, turning a best-practice recommendation into an urgent remediation task.
Second-order effects
- Certificate authorities and browser vendors face pressure to hard-accelerate SHA-1 rejection, since attackers no longer need Google's compute budget to rerun a proven method at lower cost over time.
- Vendors like Facebook that flagged migration friction during the 2015 sunset debate must absorb the transition they warned about, while security-key and high-risk-user programs such as Google's free security keys for journalists gain a concrete example of why legacy crypto retirement matters.
Third-order effects
- The episode establishes a template Google itself follows later: when a hash or cipher nears practical breakage, run the demonstration attack, publish artifacts, and force a dated industry migration — the same playbook behind its 2029 post-quantum cryptography deadline.
- Cryptographic lifecycles become managed programs with public deadlines rather than emergency patches, shifting responsibility from individual operators reacting to breaches toward coordinated deprecation schedules set by large platform vendors.
The trend: Cryptography is moving from reactive patching after breaks to planned, vendor-led migrations with public deadlines, where demonstrating an attack is the trigger for retiring an algorithm.