SHA-256 security margin shrinks again: 39-round collision attack improves prior art by 30+ bits
IgorCarron · x · 2026-10-24
A cryptanalysis researcher reports a new collision attack on reduced 39-round SHA-256, improving prior art by over 30 bits, plus the first differential attack at that round better than generic search. SHA-256 itself is not broken — its security margin simply loses another round.
The attack builds on prior work (ePrint 2026/1120) with a new insight: letting the first two state words stay free, recasting a critical condition at step 16 as a claw-search problem instead of a probabilistic filter. The author spent days watching SAT solver logs, burning cores, and arguing with Claude about what was possible.
More from Safety
- AI security research finds only known bug classes — but with '10,000x' the time — yacineMTB · 2026-10-25
- Decompiled Samsung TV finds mics on connected devices and sends audio to Bixby — PMinervini · 2026-10-25
- Honeypot catches suspected RCE within 26 hours of going live — moyix · 2026-10-25
- OrcaRouter Releases Abliterated DeepSeek V4.1 Flash With 1M Context for Verified Security Researchers — brhydon · 2026-10-25
- AI is the security debt collector: exploits now found in hours — wunderwuzzi23 · 2026-10-25
- EFF warns Canada's C-22 surveillance bill would put citizens at risk amid too many tech vulnerabilities — MikeBirdTech · 2026-10-25