It&#x27;s definitely a neat demonstration that he can produce a collision for these favourable &quot;neutral-bit&quot; IV&#x27;s relatively cheaply.<p>I suppose the next steps are to find two inputs that produce favourable IV&#x27;s, then repeat this process for those, and that seems like it&#x27;s getting really close. Stevens actually already has the best near-collision in non-reduced SHA-1 I know about from this paper:<p><a href="http:&#x2F;&#x2F;marc-stevens.nl&#x2F;research&#x2F;papers&#x2F;EC13-S.pdf" rel="nofollow">http:&#x2F;&#x2F;marc-stevens.nl&#x2F;research&#x2F;papers&#x2F;EC13-S.pdf</a><p>I made a quick visualization of it here, it looks pretty cool:<p><a href="https:&#x2F;&#x2F;lock.cmpxchg8b.com&#x2F;shatter&#x2F;visualize.html?stevens=1" rel="nofollow">https:&#x2F;&#x2F;lock.cmpxchg8b.com&#x2F;shatter&#x2F;visualize.html?stevens=1</a><p>I also added the Shappening vectors:<p><a href="https:&#x2F;&#x2F;lock.cmpxchg8b.com&#x2F;shatter&#x2F;visualize.html?shappening=1" rel="nofollow">https:&#x2F;&#x2F;lock.cmpxchg8b.com&#x2F;shatter&#x2F;visualize.html?shappening...</a><p>It&#x27;s funny that they actually collide around R74, then he has to diverge again so that when you add the IV (part of the process of creating the IV for the next block) they collide.