3 ms·
The issue is that your commit still has to do something useful and have the proper colliding hash, which dramatically increases the effective collision complexi
by Salgat 5y ago
The issue is that your commit still has to do something useful and have the proper colliding hash, which dramatically increases the effective collision complexity for something that is already nearly impossible to occur. Sure you could have some garbage commit with a colliding hash, but all that means is an inconvenience while they remove that commit.
- m_eiman 5y agoWell, you can just comment out the garbage you create to match the hash so that's not a big problem in the case of source code. Creating a correct binary file may or may not be a bigger problem, depending on the file format.
- staticassertion 5y agoYou're correct and this should be obvious. It's demonstrated already by 'shattered' where the colliding PDFs both render properly.
- staticassertion 5y ago> for something that is already nearly impossible to occur As the link suggests, it is nowhere near impossible, and well funded attackers can produce collisions extremely quickly. Git also uses sha1 for signing commits, which is another area where it relies on it for security.