collision resistance

A collision is two different messages that grind down to the identical digest. Because outputs are fixed-length and inputs are unlimited, collisions must exist; collision resistance means nobody can practically find such a pair, even when free to choose both messages.

The cost is set by the birthday bound. Since an attacker controls both inputs, they only need about 2^(n/2) hash evaluations for an n-bit output — the same counterintuitive math as the birthday paradox, where 23 people suffice for a shared birthday. So SHA-256's 256-bit output gives only about 128-bit collision security, not 256. This is precisely why digest lengths are chosen at twice the desired security level.

Blockchains assume one digest binds to exactly one content. Merkle roots, block hashes, transaction IDs, and commitments all break if you can craft two objects with the same hash: you could show a verifier one block (or leaf, or transaction) and later swap in the colliding twin, defeating immutability. This is not theoretical — MD5 fell long ago, and a real SHA-1 collision (the 2017 SHAttered PDFs) was produced for about 2^63 work, which is why both are banned from new protocol designs.