The bet that nobody can find two inputs with the same MD5 or SHA-1 fingerprint. It lost: collisions are now cheap to make.
The idea: A collision attack doesn't run the hash backwards. It exploits the hash's inner workings to steer two different inputs toward the same output. For MD5, Wang's team found input differences that cancel out step by step inside the hash. Once two inputs collide, anything appended to both keeps them colliding, which is how attackers build two meaningful documents with the same fingerprint.
Why it matters: Shows that hash functions age, and that migrating early matters.
The details
On the map: ✗ MD5 broken 2004, SHA-1 2017. Chosen-prefix: MD5 2007, SHA-1 2020
MD5 (1992) and SHA-1 (1995) were the standard hash functions for over a decade. Both lost collision resistance:
MD5: Wang and Yu found collisions in 2004[1], and by 2007 Stevens, Lenstra and de Weger[2] could make chosen-prefix collisions, where both colliding inputs start with content the attacker picks, which is what forging real documents needs.
SHA-1: the first collision was published in 2017 (SHAttered, by Google and CWI)[3], and a chosen-prefix collision in 2020 (Leurent and Peyrin)[4], used to forge PGP key certifications.
Their preimage resistance still holds in practice, so the damage is to anything that relies on collisions being hard: signatures over hashes, certificates, deduplication. Certificate authorities stopped issuing SHA-1 certificates in 2016 and browsers stopped accepting them in 2017[5].
Xiaoyun Wang and Hongbo Yu. How to Break MD5 and Other Hash Functions. Advances in Cryptology – EUROCRYPT 2005. doi:10.1007/11426639_2
Marc Stevens, Arjen Lenstra and Benne de Weger. Chosen-Prefix Collisions for MD5 and Colliding X.509 Certificates for Different Identities. Advances in Cryptology - EUROCRYPT 2007. doi:10.1007/978-3-540-72540-4_1
Marc Stevens, Elie Bursztein, Pierre Karpman et al. The First Collision for Full SHA-1. Advances in Cryptology – CRYPTO 2017. doi:10.1007/978-3-319-63688-7_19