What is a hash collision?
A hash collision happens when two different inputs produce exactly the same digest. Collisions always exist in theory: a hash function maps inputs of unlimited size onto a fixed number of outputs, 2^256 of them for SHA-256, so by the pigeonhole principle some inputs must share an output. A secure cryptographic hash makes those pairs practically impossible to find. That property, collision resistance, is what allows a 32-byte digest to stand in for a contract, a certificate or a software package.
Collision resistance vs. preimage resistance
Hash security is described by three properties, and each fails differently:
- Preimage resistance: given a digest, you can't find any input that produces it. This is what makes a hash one-way.
- Second-preimage resistance: given one input, you can't find a different input with the same digest.
- Collision resistance: you can't find any two inputs with the same digest, even when you choose both.
Collision resistance is the hardest to keep, because the attacker controls both inputs and benefits from the birthday bound of about 2^(n/2) work for an n-bit hash. It is usually the first property to fall when an algorithm weakens. Losing it doesn't automatically make preimages easy: MD5 still has no practical preimage attack, which is why it can still catch accidental file corruption even though it is unfit for security.
Real collisions in MD5 and SHA-1
A team led by Xiaoyun Wang published practical MD5 collisions in 2004. In 2008 researchers used a chosen-prefix MD5 collision to build a rogue intermediate CA certificate that browsers would have trusted, and in 2012 the Flame espionage malware used a related technique to pass itself off as signed Microsoft code. SHA-1 held out longer. In 2017 the SHAttered project from Google and CWI Amsterdam released two different PDF files with the same SHA-1 digest, after roughly 2^63 SHA-1 computations. Run both files through sha1sum and the 40-character outputs are identical; run them through sha256sum and the outputs differ completely. Chosen-prefix SHA-1 collisions, in which the attacker starts from two meaningful documents of their own choosing, followed in 2020.
Why collisions matter
Anything that trusts a hash as a stand-in for content inherits the risk:
- Digital signatures and certificates sign a digest, so two colliding documents share one valid signature.
- Code signing and software updates could accept a malicious file that collides with a signed one.
- Allow lists, deduplication and evidence hashes may treat two different files as the same file.
For these reasons the CA/Browser Forum banned new SHA-1 TLS certificates from 2016, browsers stopped trusting them in 2017, and NIST plans to retire SHA-1 entirely by the end of 2030. Non-cryptographic checksums such as CRC-32 offer no collision resistance at all, since colliding files can be crafted at will, so they belong only in error detection.
Hash collision vs. birthday attack
A collision is the outcome; a birthday attack is the generic method of finding one by generating many inputs and waiting for a match. Cryptanalytic attacks such as those against MD5 and SHA-1 find collisions much faster than the birthday bound by exploiting the algorithm's internal structure. Either way the remedy is the same: move to a hash whose collision resistance still holds, such as SHA-256, SHA-384 or SHA-3.
Hash collision on the CompTIA Security+ exam
Hash collisions are taught with hashing algorithms under SY0-801 objective 1.3, the cryptographic solutions objective, and MD5 or SHA-1 still used for signatures or certificates is a cryptographic vulnerability under objective 2.4. Wording such as "two files with different contents produced the same hash" or "a forged certificate shares a signature with a legitimate one" points to a collision, and the property that failed is collision resistance. Distractors include preimage resistance, which is about working backward from a single digest, salting, which protects password hashes against precomputed tables, and the avalanche effect.