Well, we can lower bound it using physical limitations. An irreversible bit operation (e.g., xoring or anding two bits together), by Landauer's principle [1], costs at least 7.92x10^-28 kWh.I don't know what is the minimum number of bit operations on SHA-256, but it must be at least 256 times 64 rounds. A collision attack costs approximately 2^128 evaluations, which gives us 256x64x7.92x10^-28x2^128 ~ 2^52 kHw for a collision. This is an extremely optimistic lower bound: the real cost would be many orders of magnitude higher.
For comparison, the current global annual energy consumption is estimated to be ~2^47 kWh [2].
Comments
Well, we can lower bound it using physical limitations. An irreversible bit operation (e.g., xoring or anding two bits together), by Landauer's principle [1], costs at least 7.92x10^-28 kWh.I don't know what is the minimum number of bit operations on SHA-256, but it must be at least 256 times 64 rounds. A collision attack costs approximately 2^128 evaluations, which gives us 256x64x7.92x10^-28x2^128 ~ 2^52 kHw for a collision. This is an extremely optimistic lower bound: the real cost would be many orders of magnitude higher.
For comparison, the current global annual energy consumption is estimated to be ~2^47 kWh [2].
[1] https://en.wikipedia.org/wiki/Landauer's_principle
[2] https://en.wikipedia.org/wiki/World_energy_consumption