SHA-1 'fully and practically broken' by new collision (2020)
1–10 of 210 posts
Re: SHA-1 'fully and practically broken' by new collision (2020)
#2(Jan 7, 2020)
Re: SHA-1 'fully and practically broken' by new collision (2020)
#3Reminder that GitHub has blocked Git commit collisions since 2017, and as far as anybody is aware hasn't seen one in the wild.
https://github.blog/2017-03-20-sha-1-collision-detection-on-...
Re: SHA-1 'fully and practically broken' by new collision (2020)
#4The chosen-prefix collision with a complexity of 2^63.4 (2020).
Re: SHA-1 'fully and practically broken' by new collision (2020)
#5thats it, it's over, git is finished
Re: SHA-1 'fully and practically broken' by new collision (2020)
#6[deleted]
Re: SHA-1 'fully and practically broken' by new collision (2020)
#7Reminder that GitHub has blocked Git commit collisions since 2017, and as far as anybody is aware hasn't seen one in the wild. https://github.blog/2017-03-20-sha-1-collision-detection-on-...
Random collisions in 160-bit space are incredibly unlikely. This is talking about intentional collision, and means that it's entirely feasible for someone with significant compute power to create a git commit that has the exact same hash as another git commit. This could allow someone to silently modify a git commit history to e.g. inject malware or a known "bug" into a piece of software. The modified repository would be indistinguishable if you're only using git hashes.
Git's uses SHA-1 for unique identifiers, which is technically okay as long as they are not considered secure. If git were designed today it would probably use SHA2 or SHA3 but it's probably not going to change due to the massive install base.
Edit: anyone know if git's PGP signing feature creates a larger hash of the data in the repo? If not maybe git should add a feature where signing is done after the computation of a larger hash such as SHA-512 over all commits since the previous signature.
Re: SHA-1 'fully and practically broken' by new collision (2020)
#8Obligatory link: https://shattered.io/
Re: SHA-1 'fully and practically broken' by new collision (2020)
#9> The technique that the researchers developed is quite complex and required two months of computations on 900 individual GPUs.
Re: SHA-1 'fully and practically broken' by new collision (2020)
#10Reminder that GitHub has blocked Git commit collisions since 2017, and as far as anybody is aware hasn't seen one in the wild. https://github.blog/2017-03-20-sha-1-collision-detection-on-...
Random collisions in 160-bit space are incredibly unlikely. This is talking about intentional collision, and means that it's entirely feasible for someone with significant compute power to create a git commit that has the exact same hash as another git commit. This could allow someone to silently modify a git commit history to e.g. inject malware or a known "bug" into a piece of software. The modified repository woul…
Looks like there's a migration plan for git to SHA-256: