4 ms·
Regardless of whether or not it was intended for security, it is used for security now, via signed git commits and git tags. Lots of projects rely on them, and
by petertodd 10y ago
Regardless of whether or not it was intended for security, it is used for security now, via signed git commits and git tags. Lots of projects rely on them, and there aren't good alternatives yet; using third-party services like GitHub without signed git commits is very foolish.
Fortunately it's only becoming possible for attackers to create pairs of messages that have the same SHA1 hash; an attacker still can't create a collision between a message of their choosing and an arbitrary SHA1 hash, and that type of attack is probably a long way off. But that's not much safety margin!
- ploxiln 10y agoA scheme to generate (and sign) a SHA512 hash that more directly incorporates the full state of the repo was invented, and is used by some projects incl. nodejs https://github.com/cgwalters/git-evtag https://github.com/cgwalters/git-evtag https://github.com/nodejs/node/issues/7579 https://github.com/nodejs/node/issues/7579 I personally think it's overkill
- petertodd 10y agoOh, interesting! I do something not unlike that with my OpenTimestamps git commit signing: https://petertodd.org/2016/opentimestamps-git-integration https://petertodd.org/2016/opentimestamps-git-integration I don't describe it in that post unfortunately, as I still consider the git tree "rehashing" support to be alpha-level, but I'll look into git-evtag.