 <p>A <a href="https://marc-stevens.nl/research/sha1freestart/">76-round collision</a> was found by <a href="https://marc-stevens.nl/research/">Marc Stevens</a>.</p> <p>Cryptographer Jean-Philippe Aumasson, co-creator of <a href="https://en.wikipedia.org/wiki/BLAKE_%28hash_function%29">BLAKE</a> and <a href="https://en.wikipedia.org/wiki/SipHash">SipHash</a> and initiator of the <a href="https://en.wikipedia.org/wiki/Password_Hashing_Competition">Password Hashing Competition (PHC)</a>, guesses an SHA1 collision on the full 80 rounds <a href="https://twitter.com/veorq/status/594072335205978112">will have been found by 2020</a>.</p> <p>According to <a href="https://sites.google.com/site/itstheshappening/">ongoing research by Marc Stevens et al. published in October 2015</a>,</p> <blockquote> <p>... we estimate the SHA-1 collision cost <strong>today</strong> (i.e., Fall 2015) between <strong>75K$ and 120K$</strong> renting Amazon EC2 cloud computing over a few months. By contrast, security expert Bruce Schneier previously projected the SHA-1 collision cost to be ~173K$ by 2018.</p> </blockquote> <p>They also describe a collision attack for SHA1's compression function.</p>