It's time to panic, a SHA-1 collision has been published!

Now we need a chosen prefix collision

That's where the real fun starts

Hey @SEJPM @EllaRose My idea to pick $F(k,R)$ did not work finally. Do we maybe pick $\sigma(R)=AR+B$ and $F(k,R)=\sigma(R)+k$, for $A,B$ such that we cannot solve the relations that we get for $R_0$ and $L_0$ ?