Whatever happened to SHA-256 support in Git? [LWN.net]

Whatever happened to SHA-256 support in Git?

Posted Jun 24, 2022 0:07 UTC (Fri) by wahern (subscriber, #37304)
In reply to: Whatever happened to SHA-256 support in Git? by NYKevin
Parent article: Whatever happened to SHA-256 support in Git?

Chosen-prefix attacks have already been demonstrated.[1] SHA-1 is as dead as MD-5. Which is to say, not entirely, but nobody who cares about their reputation wants to be in the company of those quibbling about how it can still be used for this or that.

[1] https://eprint.iacr.org/2020/014.pdf

to post comments

Whatever happened to SHA-256 support in Git?

Posted Jun 24, 2022 1:27 UTC (Fri) by bartoc (guest, #124262) [Link]

Well, md5 has a (somewhat computationally theoretical) full preimage attack, and it's chosen prefix attacks and general collision attack algorithms are somewhat faster than those for SHA-1. I kinda suspect it's cheaper to social engineer code into most git repos than it is to try and find a SHA-1 collision (not to mention simply finding and inserting the colliding object may not be enough to cause the modified code to spread).

It is about time to start switching over to sha-256, but of all the overdue migrations away from harmful stuff in the world SHA-1 git repos are .... not that harmful.