Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus on Git and SHA-1

plus.google.com

Post reply on HN
Print view View original

181–187 of 187 posts

Re: Linus on Git and SHA-1

#181

Post by AgentME »

oleganza wrote: post #163
AgentME wrote: post #59

Earlier quoted context omitted.

A successful preimage attack against a cryptographic hash would most likely find you a different message that gets you the same hash. You wouldn't do a preimage attack to find what the original input to create a hash was. You would do a preimage attack to find a new input with the same hash so that you could pass this new input around claiming it was the original (and have any signatures for the old input be valid fo…

What you described is called "second preimage attack", that's != "first preimage attack".

In a second preimage attack, you start with an input that comes out to a hash, and you're tasked with making a distinct input that comes out to a hash.

In a first preimage attack, you start with only the hash, and have to come up with an input from scratch that comes out to that hash. Even in a first preimage attack, you're extremely unlikely to craft the same input that someone else used to create the hash you were given. By pigeonhole principle, the number of inputs that come out to a shorter hash is extreme.

Re: Linus on Git and SHA-1

#182

Post by bascule »

ProblemFactory wrote: post #138
bascule wrote: post #114

Earlier quoted context omitted.

I am likewise perplexed why "cryptographic hash functions are unnecessary in the absence of an attacker" is such a difficult concept for you to grasp. It is not an "odd angle". It is literally the very purpose for which they were created in the first place: to defend against attacks (preimage, collision) If there are no attackers, the cryptography buys you nothing and merely makes the system slower. Again, to go back…

I recently worked on a project where I had to choose a hash function for non-cryptographic error checking. I investigated CRC in detail for it, even wrote two different implementations from scratch. CRC-X is complicated to use and terrible choice. First of all, it is not a single algorithm, it is a family of algorithms . For a CRC of size N, you have to also choose a N-bit polynomial, N-bit starting value, and N-bit…

I'm glad you've at least looked into this, but you have a number of things wrong:

  First of all, it is not a single algorithm, it is a family of algorithms
This argument holds for SHA1, but all modern cryptographic hash functions are also families. The SHA3 family has SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE128, and SHAKE256

  For a CRC of size N, you have to also choose a N-bit
  polynomial, N-bit starting value, and N-bit output XOR
  value. There is no single standard, there are tens or
  hundreds of popular options
Apparently you've never heard of CRC32C!

http://www.evanjones.ca/crc32c.html

  Most programming languages have some CRC32 implementation
  - but do not document what parameters they use, or use
  different notation for the same parameters (forward and   
  reverse), or do not let you change the parameters, or do   
  not let you change the CRC size, or all of these. There is 
  no easy way to get a "standard CRC64 or CRC128" compatible 
  across platforms without putting it together from github  
  snippets and example code yourself.
Here's CRC32C implementations in a handful of popular languages:

- C: https://software.intel.com/en-us/node/503522

- Java: http://download.java.net/java/jdk9/docs/api/java/util/zip/CR...

- JavaScript: https://www.npmjs.com/package/fast-crc32c https://www.npmjs.com/package/crc32c

- Go: https://github.com/jacobsa/gcloud/blob/master/gcs/gcsutil/cr...

- Python: https://github.com/ludios/pycrc32c

- Ruby: http://www.rubydoc.info/gems/digest-crc/0.4.1/Digest/CRC32c

And again, I'm not actually recommending git switch to CRC (as a fan of security, I would prefer they use an actual collision resistant hash function). But CRC better meets Linus's stated requirements:

  - CRC will be faster (much faster as in ~4X, your numbers seem off to me) in almost all cases
  - CRC will *not* fail to detect a bitflip, whereas there's a certain probability a random oracle-based construction will

Re: Linus on Git and SHA-1

#183

Post by [deleted] »

joatmon-snoo wrote: post #172
azernik wrote: post #141

Earlier quoted context omitted.

My takeaway from all that - the git project is internally taking steps to mitigate vulnerabilities from this particular attack (making it harder to insert the arbitrary binary data necessary into git metadata), but a) is just throwing up their hands at the problem of projects that store binary blobs like image data in their repos, and b) is not taking this as a signal that more serious sha-1 attacks are on the horizo…

> a) is just throwing up their hands at the problem of projects that store binary blobs like image data in their repos, and b) is not taking this as a signal that more serious sha-1 attacks are on the horizon and they should speed up their hash-replacement efforts. As @tytso points out, there is ongoing work to replace the use of SHA-1. Also, yes, SHAttered raises serious concerns about the safety of SHA-1, but that…

[deleted]

Re: Linus on Git and SHA-1

#184

Post by coldtea »

fao_ wrote: post #157
tytso wrote: post #156

Earlier quoted context omitted.

That's not all "the git project" is doing. Work to allow git to support an alternate crypto checksums is on-going. One of the key steps is to replace the hard-coded use of char[40] with a "struct object_id" object, and it is about 40% done[1]. [1] http://public-inbox.org/git/20170217214513.giua5ksuiqqs2laj@... Like many volunteer projects, the work would go faster if more people helped. What "the git project" conside…

> people will cut and paste command lines from web pages [...] into root shells all the time! Do they? I've never encountered anyone using a root shell to go about their business unless they had to do some exclusive operation that could only be done as root, and even then they would rather just sudo that specific operation . Hell, even if they do do that, they have bigger problems than just git, given that cut and pa…

>Do they? I've never encountered anyone using a root shell to go about their business unless they had to do some exclusive operation that could only be done as root, and even then they would rather just sudo that specific operation.

Maybe you should encounter more devs?

Re: Linus on Git and SHA-1

#185

Post by coldtea »

DannyBee wrote: post #169
ploxiln wrote: post #167

Earlier quoted context omitted.

Thus my qualification "well known". I was aware of monotone and Darcs ... but never used them, or knew anyone who did, or anyone who seriously considered it. I have no idea if Darcs is "cryptographically secure". But both of these were experimental and extremely slow at the time git was designed.

"Thus my qualification "well known"." So that, to you, means "i don't know anyone who used them"? Because that's a pretty small definition of "well known". For reference: Inside the VCS community, they were very well known. Graydon also went on to start Rust, of course. Outside of that, even to corporations I dealt with (i was working on SVN at the time), plenty knew it existed, a few evaluated it. " But both of thes…

>Inside the VCS community, they were very well known.

Inside the PL community, tons of obscure language with less than 10.000 users are "well known". Being known inside some niche's expert's a pretty low bar. The "VCS" community is insignificant in size compared to the developer community at large.

>Graydon also went on to start Rust, of course.

Which is irrelevant as to whether Darcs and Monotone are well known.

Re: Linus on Git and SHA-1

#186

Post by fao_ »

coldtea wrote: post #184
fao_ wrote: post #157

Earlier quoted context omitted.

> people will cut and paste command lines from web pages [...] into root shells all the time! Do they? I've never encountered anyone using a root shell to go about their business unless they had to do some exclusive operation that could only be done as root, and even then they would rather just sudo that specific operation . Hell, even if they do do that, they have bigger problems than just git, given that cut and pa…

> Do they? I've never encountered anyone using a root shell to go about their business unless they had to do some exclusive operation that could only be done as root, and even then they would rather just sudo that specific operation. Maybe you should encounter more devs?

I'm a developer, who works alongside other developers, on a floor full of developers. Not only does this apply to my work, but also at hack[spaces|athons] and jams I've been to (With ages ranging from ~8 - >30). I've literally never encountered anyone using su for a command that doesn't need it. Even when they need root, they just use sudo for that command.

Re: Linus on Git and SHA-1

#187

Post by coldtea »

fao_ wrote: post #186
coldtea wrote: post #184

Earlier quoted context omitted.

> Do they? I've never encountered anyone using a root shell to go about their business unless they had to do some exclusive operation that could only be done as root, and even then they would rather just sudo that specific operation. Maybe you should encounter more devs?

I'm a developer, who works alongside other developers, on a floor full of developers. Not only does this apply to my work, but also at hack[spaces|athons] and jams I've been to (With ages ranging from ~8 - >30). I've literally never encountered anyone using su for a command that doesn't need it. Even when they need root, they just use sudo for that command.

Well, you'd be surprised.
Post reply on HN