Multicollision attack
Finding many messages with the same hash – which, for iterated hash functions, turns out to be almost as cheap as finding two.
Antoine Joux showed in 2004 that a Merkle–Damgård hash has a built-in weakness. Find a collision for the first block, then another collision for the second block starting from the shared intermediate state, and so on. After k steps you have 2k messages with the same hash, for the price of just k ordinary collisions.
The awkward consequence hit a popular defensive habit: concatenating two hash functions, such as MD5 and SHA-1, in the hope of getting the sum of their strengths. Using Joux's method you build a large multicollision in one and search it for a collision in the other. The result is barely stronger than the better of the two. It became one of the arguments for so-called wide-pipe designs, whose internal state is wider than the output – an idea also visible in SHA-3.