4 ms·
If you sign the SHA1, how does that make you any more secure against collisions?
by ikeboy 11y ago
If you sign the SHA1, how does that make you any more secure against collisions?
- jacques_chester 11y agoBecause an attack will need both your signing key/certificate and a plausible collision text.
- jessaustin 11y agoISTM if an attacker had the former she wouldn't need the latter? That is she would produce the evil commit and its hash herself, and then sign that hash. I may be misunderstanding something?
- minitech 11y agoNo, just the header of the commit (i.e. just the SHA-1) is signed. The signature you used on the valid commit would work if tacked onto the malicious one.
- jacques_chester 11y agoGotcha.