3 ms·

I think the GP question is not trivial. The rationale behind SHA-1 being obsolete is that it will be used for password protection. The back end stores Hash(pas

I think the GP question is not trivial. The rationale behind SHA-1 being obsolete is that it will be used for password protection. The back end stores Hash(password+salt) and uses it to grant access. Finding any password_prime which causes a collision with password on Hash(p+salt) will brake the security of that scheme. In this case, instead, the problem from the point of view of the attacker is to find repository_prime such that... 1. Is a syntactically correct program... 2. It is syntactically and semantically close enough to repository_orig that it will not be discovered by simple inspection. 3. The delta between repository_prime and repostory_orig causes a useful side effect in the program behavior (from the point of view of the attacker). 4. The delta between repository_prime and repostory_orig does not introduce other significant and unintended side effects that will trigger investigation beyond simple inspection from some legitimate maintainer. I will say that this is a much higher bar to cross than merely "no collision shall be found". And if you are concerned that SHA-1 is not enough to protect against such attack, you probably have to consider that SHA-2 may not be enough either... You probably need to use half a dozen of cryptographically strong hash functions, preferably based on different principles, so that we ensure that at no possible delta can simultaneously fulfill all the 4 points above for every hash function. And if you have reached that level of paranoia, you need to consider that the adversary will simply not bother and chose a different attack vector, like exploiting the bureaucracy of your commit process...

lomnakkus 11y ago
... and yet SHA-256 would cost basically nothing to use instead. While your argument "for" SHA-1 requires all kinds of qualifiers and assumptions. Just say no to SHA-1.
dchest 11y ago
First of all, this has nothing to do with passwords. Indeed, this may be a higher bar to cross, but higher bars are usually being crossed. For years we known that RC4 had biases, but it was considered okay until we discovered that it was not okay after all. MD5 collisions led to rogue certificates. It's not correct that SHA-2 is not enough to fix the issue. While they share some design structure, SHA-2 is not broken, while SHA-1 is. Also, the proposal for multiple hash functions isn't particularly good: collision resistance of many cascaded hash functions is not much better than the maximal resistance of one hash function used in the cascade. It doesn't make sense to use a broken cryptographic hash function in a new project that does need cryptography. There are faster modern cryptographic hashes than SHA-1. And it doesn't make sense to use a broken cryptographic hash function in a new project that doesn't need cryptography. There are faster modern non-cryptographic hashes than SHA-1. To be fair, I don't know why we even have a discussion about this if cryptographers say that SHA-1 shouldn't be used, and you're trying to defend this choice for exactly what reason?
- philsnow 11y ago
  > SHA-2 is not broken, while SHA-1 is this kind of bare statement benefits greatly from a citation > collision resistance of many cascaded hash functions is not much better than the maximal resistance of one hash function used in the cascade I don't think GP is suggesting including results of hashes in the contents to be hashed by subsequent hash functions, but rather calculating MD5(contents), SHA1(contents), SHA2(contents), FOO4(contents) etc, and then concatenating all the hashes together. Or am I misunderstanding and this kind of scheme is exactly the "cascading" that you're talking about ?
  - dchest 11y ago
    > this kind of bare statement benefits greatly from a citation Seriously? > I don't think GP is suggesting including results of hashes in the contents to be hashed by subsequent hash functions, but rather calculating MD5(contents), SHA1(contents), SHA2(contents), FOO4(contents) etc, and then concatenating all the hashes together. Or am I misunderstanding and this kind of scheme is exactly the "cascading" that you're talking about ? Yes, this is cascading. See this paper: https://www.iacr.org/archive/crypto2004/31520306/multicollisions.pdf https://www.iacr.org/archive/crypto2004/31520306/multicollis...

lomnakkus 11y ago

... and yet SHA-256 would cost basically nothing to use instead. While your argument "for" SHA-1 requires all kinds of qualifiers and assumptions. Just say no to SHA-1.

dchest 11y ago

First of all, this has nothing to do with passwords. Indeed, this may be a higher bar to cross, but higher bars are usually being crossed. For years we known that RC4 had biases, but it was considered okay until we discovered that it was not okay after all. MD5 collisions led to rogue certificates. It's not correct that SHA-2 is not enough to fix the issue. While they share some design structure, SHA-2 is not broken, while SHA-1 is. Also, the proposal for multiple hash functions isn't particularly good: collision resistance of many cascaded hash functions is not much better than the maximal resistance of one hash function used in the cascade. It doesn't make sense to use a broken cryptographic hash function in a new project that does need cryptography. There are faster modern cryptographic hashes than SHA-1. And it doesn't make sense to use a broken cryptographic hash function in a new project that doesn't need cryptography. There are faster modern non-cryptographic hashes than SHA-1. To be fair, I don't know why we even have a discussion about this if cryptographers say that SHA-1 shouldn't be used, and you're trying to defend this choice for exactly what reason?

philsnow 11y ago
> SHA-2 is not broken, while SHA-1 is this kind of bare statement benefits greatly from a citation > collision resistance of many cascaded hash functions is not much better than the maximal resistance of one hash function used in the cascade I don't think GP is suggesting including results of hashes in the contents to be hashed by subsequent hash functions, but rather calculating MD5(contents), SHA1(contents), SHA2(contents), FOO4(contents) etc, and then concatenating all the hashes together. Or am I misunderstanding and this kind of scheme is exactly the "cascading" that you're talking about ?
- dchest 11y ago
  > this kind of bare statement benefits greatly from a citation Seriously? > I don't think GP is suggesting including results of hashes in the contents to be hashed by subsequent hash functions, but rather calculating MD5(contents), SHA1(contents), SHA2(contents), FOO4(contents) etc, and then concatenating all the hashes together. Or am I misunderstanding and this kind of scheme is exactly the "cascading" that you're talking about ? Yes, this is cascading. See this paper: https://www.iacr.org/archive/crypto2004/31520306/multicollisions.pdf https://www.iacr.org/archive/crypto2004/31520306/multicollis...