Security of a git tree [LWN.net]

Security of a git tree

Posted Mar 28, 2011 11:01 UTC (Mon) by nye (guest, #51576)
In reply to: Security of a git tree by smurf
Parent article: Arch Linux and (the lack of) package signing

>SHA1 is broken WRT collisions, i.e. you can find (with a lot of effort) two "random" bytestrings which hash to the same SHA1.

In principle yes, but nobody's ever actually done it with full SHA1 - until it gets a bit more broken than it currently is, going beyond proof-of-concept attacks on much reduced versions of SHA1 would still require more computing power than is currently feasible.

>But as SHA1 is considered "broken enough" that it should be phased out

True, it would be a bad choice for something new, but things aren't so terribly bad for SHA-1 yet - hell, there aren't even any pre-image attacks for *MD5* yet AFAIK and that's been considered utterly broken for *years*.

(Log in to post comments)