Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus' reply on Git and SHA-1 collision

marc.info

Post reply on HN
Print view View original

81–90 of 273 posts

Re: Linus' reply on Git and SHA-1 collision

#81

Post by perlgeek »

notfed wrote: post #56

Pertinent facts for the worried: 1) Git doesn't rely on SHA-1 for security. It relies on HTTPS, and a web of trust. 2) Even if git did rely on SHA-1, there's no imminent threat. What happened today was a SHA-1 collision, not a preimage attack. If a collision costs 2^n, a preimage attack costs 2^(2n). 3) Even if someone managed to pull off a preimage attack, creating a "poisonous" version of one your git repository's…

> 1) Git doesn't rely on SHA-1 for security. It relies on HTTPS, and a web of trust.

I thought that if you signed your git commits or tags with GPG, you implicitly relied on the commit checksum, and thus on SHA1.

Is that right?

Re: Linus' reply on Git and SHA-1 collision

#82

Post by sigil »

aisofteng wrote: post #54
zkms wrote: post #21

Earlier quoted context omitted.

> "what if a meteorite hit my plane while it was in flight - maybe I should add three inches of high-tension armored steel around the plane, so that my passengers would be protected" I think this is a shockingly good example of how smart people get security questions utterly wrong. The right analogy when it comes to security has to involve some type of adversary, not just random, unmotivated natural phenomena -- as l…

It was recently pointed out to me by a friend with a hobby for cryptography and mathematics that "secure" doesn't mean anything - something can only be secure with respect to a specific threat model. It seems like a straightforward, almost painfully obvious definition in retrospect now, after having it articulated to me. I think education on security manners is poor and should be a standard topic.

When possible, measure security in attacker dollars.

What's interesting here is that, just 5 years ago, the 2017 cost of this very attack (the Stevens attack) was estimated at 2^18.4 = $350k [0]. The collision announced today cost about $100k. Perhaps even less. [1]

Cloud computing is cheaper today than many expected it to be, and it seems like we're only now entering the era of fierce competition. Who knows what the next decade will bring. If your modeled attacker cost is within an order of magnitude or two of the danger zone, beware. Better to have many orders of magnitude of headroom.

Along these lines, I really like what cperciva did with attacker cost modeling in his scrypt paper. See the table on page 14 [2]. I wish more security choices were presented this way, with estimated attacker costs. Taking that even further, I wish the numbers were updated dynamically against present day hardware & compute costs. Maybe even with trendline projections. It's difficult to make good security choices without knowing costs.

[0] https://www.schneier.com/blog/archives/2012/10/when_will_we_...

[1] https://sites.google.com/site/itstheshappening/

[2] https://www.tarsnap.com/scrypt/scrypt.pdf

Re: Linus' reply on Git and SHA-1 collision

#83

Post by fulafel »

vacri wrote: post #27
petertodd wrote: post #20

Earlier quoted context omitted.

FWIW, the first warnings that SHA-1 was insecure and "It's time for us all to migrate away from SHA-1." were published prior to git's initial 2005 release: https://www.schneier.com/blog/archives/2005/02/cryptanalysis...

Because as we know, the security industry isn't a firehose of fear about everything that isn't airgapped (and then airgapping itself). Security recommendations come so thick and fast that even security researchers themselves don't bother following them. Even the bloke in your link explicitly apologises for using Word for some things, and he's considered a saint in the industry. What all the commenters here doing a ha…

Security industry != crypto academia.

Re: Linus' reply on Git and SHA-1 collision

#85

Post by [deleted] »

hermitdev wrote: post #62
DiabloD3 wrote: post #31

Earlier quoted context omitted.

The A-10 isn't a plane, it's a gun with a plane wrapped around it. And it hunts tanks.

I'm sad that the AF wants to retire this plane. This plane was defined with one purpose: build a plane around this gun, that being a 30mm autocannon firing depleted uranium shells (not radioactive) that fires at such a rate that it retards the velocity of the plane carrying the gun, and would melt the gun if it fired from full to empty continuously. The plane was built for survivability. It can withstand an engine be…

[deleted]

Re: Linus' reply on Git and SHA-1 collision

#86

Post by sampo »

nyargh wrote: post #37
lamontcg wrote: post #29

Earlier quoted context omitted.

Yeah what is the attack here? If you don't have permissions to my repo that already limits the scope of attackers to people who already have repo access. At that points there's tons of abuse avenues open that are simpler. If someone could fork a repo, submit a pull request and push a sha for an already existing commit and that would get merged and accepted (but not show up in the PR on github) well that would certain…

If the sha matched an existing one, would it be merged as part of the changeset, or just ignored?

If a sha matches, git won't fetch the object because it already has it.

Re: Linus' reply on Git and SHA-1 collision

#87

Post by [deleted] »

M_Grey wrote: post #70
braveo wrote: post #65

Earlier quoted context omitted.

What's shocking is how badly people understand the purpose of an analogy. It's to communicate an idea to another person in a way that can also convey subtleties, and not just the literal words being conveyed. In this case, he was trying to convey the idea that the risk is so small and so remote that it really isn't worth spending a lot of time on. You understood the point, I understood the point, and everyone else un…

Well you said it... it's not a misunderstanding, it's a podium.

[deleted]

Re: Linus' reply on Git and SHA-1 collision

#88

Post by xenadu02 »

dlubarov wrote: post #59

> That usually tends to make collision attacks much harder, because you either have to make the resulting size the same too, or you have to be able to also edit the size field in the header. > pdf's don't have that issue, they have a fixed header and you can fairly arbitrarily add silent data to the middle that just doesn't get shown. This doesn't seem like much of an obstacle, since you can add silent data to all ki…

Yes but the arbitrary data in the PDF doesn't have to be rendered.

It is much more difficult to change source code in a way that:

1) generates a collision 2) is still valid source code 3) the changes cause a desired effect (like a backdoor) 4) has the same file size

Re: Linus' reply on Git and SHA-1 collision

#89

Post by kqr »

stickfigure wrote: post #25

Several years ago I worked on a security product that used git as a sort of tripwire-type database. Since SHA1 was considered inadequate for Real Security, we had to hack jgit to use SHA256. It took a stupid amount of work - the 160-bit hash size was scattered all over the codebase in countless magic numbers. But it worked. The product was cancelled. I always wondered if the patch would be of any use to anyone.

160 bits are still quite many. You could have done what Linus suggests and use a better hash but truncate it. If it's a good hash, a truncation of it should still be good (modulo the fewer number of bits, of course.)

Re: Linus' reply on Git and SHA-1 collision

#90

Post by oceanswave »

zkms wrote: post #21
paulddraper wrote: post #16

Linus has toned down a lot from a decade ago. > You are _literally_ arguing for the equivalent of "what if a meteorite hit my plane while it was in flight - maybe I should add three inches of high-tension armored steel around the plane, so that my passengers would be protected". > That's not engineering. That's five-year-olds discussing building their imaginary forts ("I want gun-turrets and a mechanical horse one mi…

> "what if a meteorite hit my plane while it was in flight - maybe I should add three inches of high-tension armored steel around the plane, so that my passengers would be protected" I think this is a shockingly good example of how smart people get security questions utterly wrong. The right analogy when it comes to security has to involve some type of adversary, not just random, unmotivated natural phenomena -- as l…

Here's another example of a person getting the scenario completely wrong. The adversary here is aliens and they're lobbing meteorites to take down planes. Get your head out of the groupthink people! just because it's difficult to conceptualize the foe, doesn't mean that the foe Isn't targeting you! Collanders on!
Post reply on HN