What's the impact to something like git that makes extensive use of SHA-1?
In their example they've created two PDFs with the same SHA-1. Could I replace the blob in a git repo with the "bad" version of a file if it matches the SHA-1?
Announcing the first SHA-1 collision
11–20 of 524 posts
Re: Announcing the first SHA-1 collision
#12Good thing I use MD5 for everything... no, but as with everything else companies are really slow with upgrading their security, and many that I've seen are still using both MD5 and SHA1 for both certificates, file-hashing and "storage" of passwords. I am probably stating the obvious though...
Re: Announcing the first SHA-1 collision
#13What's the impact to something like git that makes extensive use of SHA-1? In their example they've created two PDFs with the same SHA-1. Could I replace the blob in a git repo with the "bad" version of a file if it matches the SHA-1?
Do you have a paypal account. in case if you have you can add an extra 650 a week in your pay only working on the internet two hours per day. look at this link... http://bit.ly/2atnA1a
Re: Announcing the first SHA-1 collision
#14What's the impact to something like git that makes extensive use of SHA-1? In their example they've created two PDFs with the same SHA-1. Could I replace the blob in a git repo with the "bad" version of a file if it matches the SHA-1?
Great question... Can anyone answer this? Seems ripe for exploitation.
Re: Announcing the first SHA-1 collision
#15What's the impact to something like git that makes extensive use of SHA-1? In their example they've created two PDFs with the same SHA-1. Could I replace the blob in a git repo with the "bad" version of a file if it matches the SHA-1?
[deleted]
Re: Announcing the first SHA-1 collision
#16>Nine quintillion computations; 6,500 years of CPU; 110 years of GPU
Is there a rough calculation in terms of today's $$$ cost to implement the attack?
Re: Announcing the first SHA-1 collision
#17What's the impact to something like git that makes extensive use of SHA-1? In their example they've created two PDFs with the same SHA-1. Could I replace the blob in a git repo with the "bad" version of a file if it matches the SHA-1?
It's probably doable, but your commit will be huge with a lot of comments or dummy files to make the collision possible.
Re: Announcing the first SHA-1 collision
#18What's the impact to something like git that makes extensive use of SHA-1? In their example they've created two PDFs with the same SHA-1. Could I replace the blob in a git repo with the "bad" version of a file if it matches the SHA-1?
The shattered site explicitly singles out git as at risk.
Re: Announcing the first SHA-1 collision
#19So good timing to have just started working on a sha3 version of git I guess...
Funny, just yesterday I thought about what would be necessary to change and deploy this. Apparently the SHA1 hash wasn't designed as a security feature, but I would not be surprised if it is being abused as one today.
Re: Announcing the first SHA-1 collision
#20What's the impact to something like git that makes extensive use of SHA-1? In their example they've created two PDFs with the same SHA-1. Could I replace the blob in a git repo with the "bad" version of a file if it matches the SHA-1?
This is not a pre-image attack, so you can't create a file that matches an existing SHA1. It's a collision attack, so you can create two files whose SHA1 is the same.
So what I could potentially do (given a multi-million dollar budget) is create from scratch two git repositories with different content, whose HEAD is the same. This would allow me to serve different repositories to different users.
What is currently still not feasible is to create a custom git repository whose HEAD matches that of the Linux kernel.
See also: http://crypto.stackexchange.com/questions/1173/what-are-prei...