3 ms·

> There is, however, a performance cost in using cryptographic primitives in non-security-related contexts. You may not care about performance, but it certainly

> There is, however, a performance cost in using cryptographic primitives in non-security-related contexts. You may not care about performance, but it certainly matters for something like git. The performance difference between SHA1 and SHA256 is less than 50%. Unless hashing is a significant percentage of git, which it isn't, this is an insignificant difference. http://atodorov.org/blog/2013/02/05/performance-test-md5-sha1-sha256-sha512/ http://atodorov.org/blog/2013/02/05/performance-test-md5-sha... Also, you can easily argue that version control is a security context.

bascule 10y ago
I absolutely believe git should use a cryptographically secure hash function. But you're completely missing my point, which is about Linus's claims that git's use of SHA1 isn't security-critical, but why he's using a cryptographically secure hash function anyway.
knweiss 10y ago
There are better cryptographic hash functions (e.g. Blake2) than SHA1 that are even faster. Check out the "results" slide of this slide deck for the cycles per byte table: https://blake2.net/acns/slides.html https://blake2.net/acns/slides.html