11–20 of 28 posts
They got a lot of flak for trying to deprecate it "so early". It's nice to see them proving everyone wrong on this.
Copy-pasting for posterity:
I've been informed by the git Gods that the chances of a
SHA1 collision is the same as the Earth being sucked up into
the black hole created by the CERN accelerator. If this is
indeed true, then there's no need for that extra memcmp.>...That means Git and unknown number of other widely used services that rely on SHA1 have THREE MONTHS to wean themselves and their users off the insecure function https://arstechnica.com/security/2017/02/at-deaths-door-for-...
I removed this comment from here, and posted it here: https://news.ycombinator.com/item?id=13713557
Which can be appropriate. Not every use of SHA-1 is security focused, it might also be combined with a file size and used to check for file consistency.
The same thing happened with MD5 (which is much more broken). People freaked out because some software was using the "insecure" algorithm while entirely missing that it was used a file consistency check (in combination with file size) rather than for security within its own right.
If you're doing security work, you should already know that SHA-1 is unacceptable. If you aren't doing security work then you MIGHT want to look into something else but only if there would be a benefit to someone abusing a SHA-1 collision.
StackOverflow post explaining how Git would handle a SHA-1 collision http://stackoverflow.com/questions/9392365/how-would-git-han...
> Here are some numbers that give a sense of how large scale this computation was: Nine quintillion (9,223,372,036,854,775,808) SHA1 computations in total 6,500 years of CPU computation to complete the attack first phase 110 years of GPU computation to complete the second phase So no need to panic or urgently switch, but time to slowly transition
> Had the researchers performed their attack on Amazon's Web Services platform, it would have cost $560,000 at normal pricing. Had the researchers been patient and waited to run their attack during off-peak hours, the same collision would have cost $110,000. That's within the $75,000 to $120,000 range CWI's Stevens projected in late 2015.
Not cheap but definitely achievable by a wealthy individual or corporation.
Computing a collision today costs about $100K from my reading of the paper. So most uses of SHA1 are protecting documents of far lower value, and would not be likely attack targets (today).