Hacker News Reader

Boomerang attacks on SHA-0 have a complexity on the order of 2^33.

The boomerang (against block ciphers) was coined in 1999. It was used against SHA-0 in 2008?

Apparently the NSA warned against SHA-0 in 1995.

So do we now know what they perceived the weakness to be? Or are we still guessing?