title: Understanding sha-1 collision weakness
body: <p>According to various sources, attacks looking for sha-1 collisions have been improved to 2^52 operations:</p>
  
  <p><a href="http://www.secureworks.com/research/blog/index.php/2009/6/3/sha-1-collision-attacks-now-252/" rel="noreferrer">http://www.secureworks.com/research/blog/index.php/2009/6/3/sha-1-collision-attacks-now-252/</a></p>
  
  <p>What I'd like to know is the implication of these discoveries on systems that are not under attack. Meaning if I hash random data, what are the statistical odds of a collision? Said another way, does the recent research indicate that a brute-force birthday attack has a higher chance of finding collisions that originally proposed?</p>
  
  <p>Some writeups, like the one above, say that obtaining a SHA-1 collision via brute force would require 2^80 operations. Most sources say that 2^80 is a theoretical number (I assume because no hash function is really distributed perfectly even over its digest space). </p>
  
  <p>So are any of the announced sha1 collision weaknesses in the fundamental hash distribution? Or are the increased odds of collision only the result of guided mathematical attacks?</p>
  
  <p>I realize that in the end it is just a game of odds, and that their is an infinitesimally small change that your first and second messages will result in a collision. I also realize that even 2^52 is a really big number, but I still want to understand the implications for a system not under attack. So please don't answer with "don't worry about it".</p>