Twenty-six years from break to scheduled retirement.

7 min read

CRYPTOGRAPHIC TRANSITION

What the SHA-1 timeline measures, and what it predicts about harder migrations.

Cryptographic transition is usually described as a plan. SHA-1 gives us something more useful: a public record with dated warnings, measured attack costs, deprecation decisions and a scheduled end.

SHA-1 entered the federal standard in 1995. The first theoretical collision attack below the generic 2⁸⁰ bound was disclosed in 2004 and published in 2005. NIST plans to remove SHA-1 from its remaining approved cryptographic uses by 31 December 2030.

Twenty-six years separate the first disclosed break from that scheduled retirement. The interval is not a measure of cryptanalysis alone. It measures how long deployed systems take to discover, replace and stop trusting an algorithm.

The timeline has different kinds of dates

Year	Event
1995	SHA-1 is published in FIPS 180-1.
2004 to 2005	Wang, Yin and Yu disclose and publish a collision attack well below the 2⁸⁰ generic bound.
2011	NIST deprecates SHA-1 for digital-signature generation.
2013	NIST disallows SHA-1 signature generation for general federal use, except where specific guidance permits it.
2017	SHAttered demonstrates the first practical collision for full SHA-1.
2020	SHA-1 is a Shambles demonstrates the first practical chosen-prefix collision.
2022	NIST announces a plan to remove SHA-1 from its remaining specified protocols by the end of 2030.
2030	Scheduled end of SHA-1 as an approved NIST cryptographic algorithm.

The dates describe different states. A theoretical break says the security claim is weaker than designed. A practical collision proves that the attack can be executed. Deprecation tells operators to stop creating new dependence. Disallowance changes policy. Retirement removes remaining approved uses.

The practical collision arrived six years after NIST deprecation and more than a decade after the theoretical warning. The ecosystem had time, but the tail still required a formal endpoint.

The cost curve became an engineering result

A generic collision search against a 160-bit hash should require about 2⁸⁰ evaluations. The 2005 attack reduced the expected work far below that level. NIST noted in 2006 that improved estimates near 2⁶³ operations were practical in principle, although no full collision had yet been demonstrated.

SHAttered crossed that line in 2017. Google and CWI reported approximately nine quintillion SHA-1 computations, equivalent to about 6,500 CPU-years for the first phase and 110 GPU-years for the second. The attack was still more than 100,000 times faster than generic brute force.

Leurent and Peyrin then made the attack operationally stronger. Their 2020 chosen-prefix collision had estimated complexity of 2^63.4 on the reference GPU. They ran the computation for two months on 900 Nvidia GTX 1060 GPUs and spent about 75,000 US dollars. Their optimized estimate was 45,000 dollars at the rental prices considered in the paper.

The relevant trend was visible long before the first colliding files. Waiting for the demonstration would have converted a predictable migration into an emergency.

Chosen-prefix is the operational break

SHAttered produced two different files with one SHA-1 digest. Both documents were constructed by the attacker. That is a decisive cryptographic break, but its direct use depends on a format that gives the attacker room to prepare both variants.

A chosen-prefix collision begins with two different prefixes selected in advance and appends crafted blocks so that the final hashes match. This lets the visible or semantic beginning of each object differ. The 2020 work demonstrated the consequence with two PGP identities and a certification signature transferable between colliding certificates.

For systems that sign a hash, the distinction matters. The attack is no longer only about proving that two artificial files can collide. It can preserve two independently meaningful prefixes while arranging one signed digest.

Retirement is slower than replacement

Replacing SHA-1 in new code is comparatively easy. SHA-256 has a familiar interface and a 32-byte digest instead of 20 bytes. The difficult part is finding every place where the old hash still carries meaning.

SHA-1 has appeared in certificate signatures, code signing, firmware verification, timestamping, PGP identity certifications, CMS objects, Git object identifiers, secure boot records, device provisioning and protocol-specific message authentication.

Each use has a different owner and a different definition of completion. A signing service can stop producing new SHA-1 signatures while an archive must continue deciding what to do with old ones. Firmware can be updated while a verification root burned into one-time-programmable memory cannot. A protocol can negotiate SHA-256 while a downgrade path still admits SHA-1.

The migration date is therefore not the day a library adds a replacement. It is the day the last relevant verifier can reject or safely isolate the old construction.

The property in use matters

Collision resistance and pseudorandomness are different properties. The published attacks break SHA-1 collision resistance. They do not directly provide the secret key needed to forge HMAC-SHA-1.

This does not make HMAC-SHA-1 a sensible choice for a new design. It means its migration urgency and failure mode are not identical to those of a SHA-1 certificate signature. NIST SP 800-131A Rev. 2 permits SHA-1 only in non-signature applications that do not require collision resistance and treats signature verification as legacy use.

An inventory that records only the string “SHA-1” loses the information needed to prioritize correctly. The useful unit is the algorithm, the property relied upon, the key size if any, the protocol position and the required lifetime of the artifact.

What the history says about post-quantum migration

The move from SHA-1 to SHA-256 is close to a shape-preserving replacement. It does not make signatures an order of magnitude larger or require a new certificate architecture. Even so, its scheduled path from theoretical break to full NIST retirement spans twenty-six years.

Post-quantum migration changes more of the system. Public keys and signatures grow. Handshakes can cross congestion and amplification limits. Constrained devices may need different buffers, streaming paths and implementation techniques. Long-lived trust anchors must coexist with old and new algorithms during transition.

The initial public draft of NIST IR 8547 proposes deprecation after 2030 for public-key mechanisms that provide 112 bits of classical security and disallowance after 2035. It proposes disallowing higher-strength quantum-vulnerable public-key mechanisms after 2035. As of this writing, those dates remain part of a draft transition plan, not a completed standard.

The comparison does not prove that a deadline is impossible. It shows what must be measured early: inventory, replacement rate, verification lifetime and the part of the fleet that cannot be changed.

Agility is a set of durations

Supporting two algorithm identifiers in an API is useful. It is not sufficient evidence of cryptographic agility. Operational agility can be measured more directly:

Inventory completeness. What proportion of keys, signed artifacts, protocols and trust anchors can be enumerated without a new discovery project?
Time to first production use. How many days pass between an approved decision and the first artifact created with the replacement?
Time to fleet coverage. How long does it take to reach 50, 90 and 99 percent? The final fraction usually contains the oldest and least reachable systems.
Verification lifetime. How long must an artifact created today remain verifiable, and how will its evidence be renewed?
Immovable tail. How many units cannot be updated, and what event will finally remove them from service?
Downgrade exposure. Can a rollback, configuration error or negotiation path restore acceptance of the retired algorithm?

These durations can be measured before the replacement algorithm is deployed. If the inventory itself takes a year, the migration has already produced its first schedule result.

The date that measures the operator

Cryptanalysts produce attack dates. Standards bodies produce policy dates. Neither describes the update capability of a particular system.

The operator is measured by the last artifact that still depends on the old property, the last verifier that can be downgraded and the last device that cannot be reached.

SHA-1’s first theoretical break was disclosed in 2004. Its final NIST retirement is scheduled for 2030. The interval between them is mostly a history of systems, ownership and lifecycle, not a history of the hash function.