Hacker News Reader

At the bottom the article mentions that the NSA said there was something wrong with SHA-0. Do we now know what that was?

Boomerang attacks on SHA-0 have a complexity on the order of 2^33.

The boomerang (against block ciphers) was coined in 1999. It was used against SHA-0 in 2008?

Apparently the NSA warned against SHA-0 in 1995.

So do we now know what they perceived the weakness to be? Or are we still guessing?