The big take-away from the article seems to be:<p>&gt; Even though freestart collisions do not directly lead to actual collisions for SHA-1, in our case, the experimental data we obtained in the process enable significantly more accurate projections on the real-world cost of actual collisions for SHA-1, compared to previous projections. Concretely, we estimate the SHA-1 collision cost today (i.e., Fall 2015) between 75K$ and 120K$ renting Amazon EC2 cloud computing over a few months.<p>So if I understand their estimates correctly, it would cost around $100,000 and several months to create your circular data structure. (Or, somewhat less trivially, compromise Git&#x27;s SHA1 integrity promise in a still-probably-useless way.)