4 ms·
> SHAtter was waived by many because the threat model didn't convincingly apply to them. Example: git. Git quickly switched to the sha1collisiondetection libra
by avar 7y ago
> SHAtter was waived by many because the threat model didn't convincingly apply to them. Example: git.
Git quickly switched to the sha1collisiondetection library[1] by default after the SHAttered attack was published. It's a SHA-1 library written by the authors of the paper which the attack.
Edit: Marc Stevens saying that existing library will mitigate this new attack: https://twitter.com/realhashbreaker/status/1128419029536923649 https://twitter.com/realhashbreaker/status/11284190295369236...
1. https://github.com/cr-marcstevens/sha1collisiondetection https://github.com/cr-marcstevens/sha1collisiondetection
- AnaniasAnanas 7y agoThat still does not solve the issue with OpenPGP signatures though, does it?
- avar 7y agoIt does, because a tag pointing to the malicious content wouldn't hash with sha1collisiondetection's modified SHA-1, just like you can't add the SHAttered PDFs to git.