3 ms·

> A… sneaky trick that Linus pulled… was to just pretend like Sha1 hashes never collide. This (false but convenient) assumption… As an infosec engineer, this i

> A… sneaky trick that Linus pulled… was to just pretend like Sha1 hashes never collide. This (false but convenient) assumption… As an infosec engineer, this is a bit disingenuous. From a statistical perspective, you can pretty much assume that it's impossible to create colliding SHA-1 hashes. In the intervening years we've discovered security flaws in SHA-1 that allow attackers to create collisions under certain circumstances. That's not great, and now we have ways to migrate repositories to SHA-256 hashes (although it's not yet the default). But this decision wasn't "sneaky". Cryptographers everywhere routinely build systems under the assumption that hash collisions can't happen, because that's an explicit design goal of hash functions. If we ever find a way that this doesn't hold true, the answer isn't to design the system around the possibility of a collision, it's to switch to a better hash.

wyoung2 4y ago
All of which is why Fossil now uses SHA3-256 by default. How long is it going to take Git to follow?
- tasuki 4y ago
  Have hash collisions in Git ever been a problem for you? What is the exact scenario in which a hash collision would be dangerous? (Like, you give some random person push access to your repository and... I'm really getting lost here... they override some commit with a different commit with the same hash? And that's somehow worse than them just creating a new commit with a different hash, which you would notice for sure? And the only reason you won't notice their Evil Change is because they sneaked it in inside a hash collision?)
  - wyoung2 4y ago
    We don't know how to push bad artifacts into a Merkle tree by exploiting SHA-1's weaknesses. The thing is, though, we didn't want to be pushed into scrambling for a better hash algorithm after some clever bastard works that trick out. :)
- yjftsjthsd-h 4y ago
  It appears that git currently has experimental, non-backward-compatible support for sha256, so I'd guess "as soon as they finish fixing any issues and figure out a nice upgrade path", with the caveat that there's little pressure because it's not actually a practical problem yet and isn't expected to be one in the foreseeable future.
  - wyoung2 4y ago
    Fossil's method is backwards-compatible, and we published the method for it five years ago (2017-03-05): https://fossil-scm.org/home/doc/trunk/www/hashpolicy.wiki https://fossil-scm.org/home/doc/trunk/www/hashpolicy.wiki

wyoung2 4y ago

All of which is why Fossil now uses SHA3-256 by default. How long is it going to take Git to follow?

tasuki 4y ago
Have hash collisions in Git ever been a problem for you? What is the exact scenario in which a hash collision would be dangerous? (Like, you give some random person push access to your repository and... I'm really getting lost here... they override some commit with a different commit with the same hash? And that's somehow worse than them just creating a new commit with a different hash, which you would notice for sure? And the only reason you won't notice their Evil Change is because they sneaked it in inside a hash collision?)
- wyoung2 4y ago
  We don't know how to push bad artifacts into a Merkle tree by exploiting SHA-1's weaknesses. The thing is, though, we didn't want to be pushed into scrambling for a better hash algorithm after some clever bastard works that trick out. :)
yjftsjthsd-h 4y ago
It appears that git currently has experimental, non-backward-compatible support for sha256, so I'd guess "as soon as they finish fixing any issues and figure out a nice upgrade path", with the caveat that there's little pressure because it's not actually a practical problem yet and isn't expected to be one in the foreseeable future.
- wyoung2 4y ago
  Fossil's method is backwards-compatible, and we published the method for it five years ago (2017-03-05): https://fossil-scm.org/home/doc/trunk/www/hashpolicy.wiki https://fossil-scm.org/home/doc/trunk/www/hashpolicy.wiki