Since the public key-based signature schemes take too much time to compute, hash functions that map messages to short digests h (M) are used.

Security researchers have achieved the first real-world collision attack against the SHA-1 hash function, producing two different PDF files with the same SHA-1 signature.