> The use of SHA-1 in Git is not for security purposes It's for verifying data integrity, which is a cryptographic task (ie for security purposes). In Linus' G

> The use of SHA-1 in Git is not for security purposes It's for verifying data integrity, which is a cryptographic task (ie for security purposes). In Linus' Google tech talk on git he actually does say it's not a security thing, but then gives an example of verifying the data want tampered with by a third party [1]. Whether or not the feature was conceived of as a security feature, it is de-facto being relied on as a security feature. There are malicious actors on the internet that try to inject malware into software repositories. The fact that they can't silently change the history makes this task harder. If a non cryptographic hash function like crc32 was used, it would be child's play to cause shenanigans with collisions. As an anecdote, I once reverse engineered the checksum used by warcraft 3 to verify that players had the custom map being played. It was not cryptographically secure. Just xoring values into a rotating accumulator [2]. Not hard to collide. Within a few months, there were versions of maps with built-in vision hacks and collided checksums being passed around. It was enough of a problem that the next game patch added sha1 as a checksum. If git had started with a non cryptographic hash function, it would have been forced to switch to one for similar reasons. 1: https://youtu.be/4XpnKHJAok8?t=3672 https://youtu.be/4XpnKHJAok8?t=3672 2: https://github.com/Strilanc/Tinker/blob/755ecbf6e06996166490819f6c4fe032bcd70c4d/Warcraft3/W3Map.vb#L401 https://github.com/Strilanc/Tinker/blob/755ecbf6e06996166490...