2 ms·
> Downloading the PDFs [1] and comparing their sizes takes less than a minute. shattered-1.pdf and shattered-2.pdf have the same size and sha-1 hash, but git i
by alexeiz 10y ago
> Downloading the PDFs [1] and comparing their sizes takes less than a minute.
shattered-1.pdf and shattered-2.pdf have the same size and sha-1 hash, but git is still able to recognize that those are two different files and creates two different commit hashes for them. So clearly just having the same size and sha-1 hash is not enough to fool git.
- Strom 10y agoGit calculates sha1(prefix+file), while the Google example was meant for sha1(file). However there is no difference in the attack. You could just as easily construct two files that have different sha1(file) but matching sha1(prefix+file).