3 ms·

The interesting thing about your comment is that you view password hashing as needing more security but git commit hashes to be less of an issue. I couldn't dis

by jmyeet 5y ago

The interesting thing about your comment is that you view password hashing as needing more security but git commit hashes to be less of an issue. I couldn't disagree more. First, for a password hash function to matter, the hashed password must be compromised. If you don't have the hash it doesn't really matter all that much. Yes, hashed passwords do get compromised but many don't. Second, I can't think of many bigger security threats than intentionally creating an SHA1 collision for a git repository. Poisoning a Linux git repo could be truly disastrous. Remember too that if you can poison a git repo, you can also make the binary output have the same size and hash too. I mean that's much more difficult but not impossible and it wouldn't surprise me if state actors have dedicated a lot of computing power to this. And "is it possible?" is by definition always "yes".

eyelidlessness 5y ago
> The interesting thing about your comment is that you view password hashing as needing more security but git commit hashes to be less of an issue. I do? I should have been more clear that I think this is another case which very much depends on the other considerations I addressed and probably many more. > And "is it possible?" is by definition always "yes". You’re not the only person to say so, and… I know. I left the possibility open in my response mainly because I wanted to focus on the other considerations without dismissing the parent comment. Even if the answer was less definitive I believe considering level and degree of risk should be a bigger factor in these conversations than what’s theoretically possible.
Salgat 5y ago
The issue is that your commit still has to do something useful and have the proper colliding hash, which dramatically increases the effective collision complexity for something that is already nearly impossible to occur. Sure you could have some garbage commit with a colliding hash, but all that means is an inconvenience while they remove that commit.
- m_eiman 5y ago
  Well, you can just comment out the garbage you create to match the hash so that's not a big problem in the case of source code. Creating a correct binary file may or may not be a bigger problem, depending on the file format.
  - staticassertion 5y ago
    You're correct and this should be obvious. It's demonstrated already by 'shattered' where the colliding PDFs both render properly.
- staticassertion 5y ago
  > for something that is already nearly impossible to occur As the link suggests, it is nowhere near impossible, and well funded attackers can produce collisions extremely quickly. Git also uses sha1 for signing commits, which is another area where it relies on it for security.

by jmyeet 5y ago

eyelidlessness 5y ago

> The interesting thing about your comment is that you view password hashing as needing more security but git commit hashes to be less of an issue. I do? I should have been more clear that I think this is another case which very much depends on the other considerations I addressed and probably many more. > And "is it possible?" is by definition always "yes". You’re not the only person to say so, and… I know. I left the possibility open in my response mainly because I wanted to focus on the other considerations without dismissing the parent comment. Even if the answer was less definitive I believe considering level and degree of risk should be a bigger factor in these conversations than what’s theoretically possible.

Salgat 5y ago

The issue is that your commit still has to do something useful and have the proper colliding hash, which dramatically increases the effective collision complexity for something that is already nearly impossible to occur. Sure you could have some garbage commit with a colliding hash, but all that means is an inconvenience while they remove that commit.

m_eiman 5y ago
Well, you can just comment out the garbage you create to match the hash so that's not a big problem in the case of source code. Creating a correct binary file may or may not be a bigger problem, depending on the file format.
- staticassertion 5y ago
  You're correct and this should be obvious. It's demonstrated already by 'shattered' where the colliding PDFs both render properly.
staticassertion 5y ago
> for something that is already nearly impossible to occur As the link suggests, it is nowhere near impossible, and well funded attackers can produce collisions extremely quickly. Git also uses sha1 for signing commits, which is another area where it relies on it for security.