Posted Feb 2, 2010 15:50 UTC (Tue) by khim
In reply to: Security in the 20-teens
Parent article: Security in the 20-teens
Of course there is at least one VCS that does not rely on hashing
for security, and instead relies on gpg signatures.
...which rely on the hashing for speed: typical GPG signature
signs not the message itself but the hash of the message! This makes it
potentially more vulnerable not less. The rest of the message is
Sure it may be good idea to use GPG signatures as defence from other
attack vectors, but to say that GPG signatures can be used as defense against
hash collisions... it's the height of folly.
to post comments)