Hash Collision Simulation

A Python simulation comparing weak collision resistance and strong collision resistance using a truncated 24-bit SHA-256 hash.

This project demonstrates how collision attacks behave in practice and experimentally illustrates the birthday paradox, a fundamental concept in cryptography.

Overview

Cryptographic hash functions are designed to resist collision attacks. Two important security properties are:

Weak Collision Resistance

Given a specific target message, it should be computationally infeasible to find a different message that produces the same hash.

Strong Collision Resistance

It should be computationally infeasible to find any two different messages that produce the same hash.

This project simulates both attack types using a truncated 24-bit SHA-256 hash. Truncation is used to make brute-force attacks feasible within a reasonable amount of time.

Features

• SHA-256 hashing with 24-bit truncation
• Weak collision attack simulation
• Strong collision attack simulation
• Configurable trial counts via command-line arguments
• Statistical analysis of trial results
• Histogram generation for attack distributions
• CSV export of experimental results

Project Structure

hash-collision-simulation/
├── outputs/
│   ├── collision_results.csv
│   ├── weak_collision_distribution.png
│   └── strong_collision_distribution.png
├── hash_collision-simulation.py
├── README.md
├── requirements.txt
└── LICENSE

Installation

Create a virtual environment:

python -m venv .venv
source .venv/bin/activate

Install dependencies:

pip install -r requirements.txt

Usage

Run with default settings:

python hash-collision-simulation.py

Specify custom trial counts:

python hash-collision-simulation.py --weak-trials 25 --strong-trials 100

Example Results

Theoretical expectations for a 24-bit hash:

Attack Type	Expected Attempts
Weak Collision	~16,777,216
Strong Collision	~4,096

Strong collision attacks require dramatically fewer attempts because they benefit from the birthday paradox.

Example Visualizations

Strong Collision Distribution

Weak Collision Distribution

Key Takeaway

This experiment demonstrates that finding a collision between any two messages is significantly easier than finding a collision for one specific target message. The results closely match the theoretical predictions derived from the birthday paradox.

Technologies Used

• Python
• hashlib
• matplotlib
• argparse
• CSV data export

License

MIT License