⬇ Download holy card: ·
Blessed SHAttered, Who Broke SHA-1
Patron of retired hash functions, certificates signed with old algorithms, and twin PDFs.
Life
On 23 February 2017 Google and CWI Amsterdam announced the first practical SHA-1 collision: two different PDFs with the same fingerprint. It took about nine quintillion SHA-1 computations, the equivalent of thousands of CPU-years and more than a hundred GPU-years. From that day no one could say SHA-1 was only theoretically broken, and browsers, Git and certificate authorities sped up the move away from it.
Prayer
O Blessed SHAttered, who gave two documents the same face, let our hashes be as long as they need to be. Amen.
How to celebrate
Celebrated by moving to SHA-256 or SHA-3 and checking that no old system still signs with SHA-1.
Two pages, one fingerprint: and trust shatters.