SHA-1 'fully and practically broken' by new collision (2020)

Post by adrian_b » Tue, Oct 12, 2021, 9:11 PM UTC

outworlder wrote: post #41

adrian_b wrote: post #39

Earlier quoted context omitted.

It is not yet possible "to create a git commit that has the exact same hash as another git commit" in the sense that if someone else has already done a commit you can make another commit with the same hash. What is possible now is something that is much easier: if you have enough money and time, you can create 2 commits with the same hash, which start with some different parts, which may be chosen arbitrarily, then t…

> presumably you can later substitute the initial commit with the other one without anybody being able to detect the substitution. How? Which operation would be involved? Will it not show anywhere else(reflog)?

Post by madars » Tue, Oct 12, 2021, 9:12 PM UTC

alerighi wrote: post #28

cletus wrote: post #25

Git was created 16 years ago. The impending breakage of SHA-1 was known even at that time, just like how MD5 had been broken before it. I'm honestly still shocked that updating the hashing algorithm wasn't built into Git from day one. I really wonder why. Did people think this wouldn't happen? Were they so in love with the performance of C/C++ being able to pass around 20 byte hashes on the stack without worrying abo…

SHA-1 will still work fine for the purpose of git. It is just no longer considered secure for cryptographic operations, such as digital signature, that doesn't mean that you can't use it for other purposes, like git does. Using it is still fine and will ever be fine. Making the hashing algorithm exchangeable would have introduces complexity in a software that is already complex, and also less efficient (one of the re…

Post by noway421 » Tue, Oct 12, 2021, 9:14 PM UTC

outworlder wrote: post #41

adrian_b wrote: post #39

Earlier quoted context omitted.

It is not yet possible "to create a git commit that has the exact same hash as another git commit" in the sense that if someone else has already done a commit you can make another commit with the same hash. What is possible now is something that is much easier: if you have enough money and time, you can create 2 commits with the same hash, which start with some different parts, which may be chosen arbitrarily, then t…

> presumably you can later substitute the initial commit with the other one without anybody being able to detect the substitution. How? Which operation would be involved? Will it not show anywhere else(reflog)?

Post by wcoenen » Tue, Oct 12, 2021, 9:15 PM UTC

elfchief wrote: post #31

cletus wrote: post #25

Git was created 16 years ago. The impending breakage of SHA-1 was known even at that time, just like how MD5 had been broken before it. I'm honestly still shocked that updating the hashing algorithm wasn't built into Git from day one. I really wonder why. Did people think this wouldn't happen? Were they so in love with the performance of C/C++ being able to pass around 20 byte hashes on the stack without worrying abo…

Git was not intended (AFAIK) to be cryptographically secure. Being unsuitable for crypto != being unsuitable for other uses.

Post by y4mi » Tue, Oct 12, 2021, 9:20 PM UTC

madars wrote: post #54

alerighi wrote: post #28

Earlier quoted context omitted.

SHA-1 will still work fine for the purpose of git. It is just no longer considered secure for cryptographic operations, such as digital signature, that doesn't mean that you can't use it for other purposes, like git does. Using it is still fine and will ever be fine. Making the hashing algorithm exchangeable would have introduces complexity in a software that is already complex, and also less efficient (one of the re…

Collisions definitely do matter for git security: many people pin explicit git hashes for their dependancies, and thus they can be tricked in running malicious forks. This requires placing a chosen commit in the git repo (so unlike second preimage break it does not mean that you could attack repos you have no control over) but that's not an unrealistic threat model overall.