Backward Expansion of SHA1 Given a SHA1 hash, is it now possible to "practically" find the source material that was passed through SHA1 now that the Shattered paper has produced the first "practical" collision?

As a follow on question - if I have the SHA1 Hash and the Source document, can I find/produce the 2nd document using the Shattered algorithm, if I know in advance that it exists?
Can you find the source material given a hash?


No, doing so would break the preimage assumption which is so far unbroken for sha1. (Assuming the message has sufficient entropy as to make brute forcing impractical)


  Can I find a 2nd document now that Shattered exists?


Yes / no. Yes, you can find many documents based on the shattered examples; but no you cannot create a new document without spending the same computations that the researchers did.

Take the two shattered examples, you can control all bytes after their distinct prefix blocks collide. All bytes after must be equal. So you're not introducing any new collisions, just extending the known collisions.

What is broken then?

Collision resistance.

You can (given lots of computing time) produce collisions just as they did in the paper, but this is still expensive. If a protocol assumes collision resistance and you pass it the two shattered files, it'll break. Likely assuming the second file is redundant, or incorrectly equivalent to the first.