Re:Linus' reply on Git and SHA-1 collision
by euyyn on Friday February 24, 2017 @01:18AM
(#13721493)
It's not so inconceivable, after seeing the PDF collision, to contribute to another project a commit whose hash has a collision with another malicious commit you keep up your sleeve. Not saying it's easy, but now it's on the horizon.
[ Parent
| on HN ]
Re:Linus' reply on Git and SHA-1 collision
by otabdeveloper on Friday February 24, 2017 @02:25AM
(#13721740)
> Not saying it's easy, but now it's on the horizon.
Not really. It's not a preimage attack. They spent several hundred dollars to find two random byte strings with the same SHA1 hash. There's still no way to SHA1-collide a specific byte string instead of random junk.
Re:Linus' reply on Git and SHA-1 collision
by victorNicollet on Friday February 24, 2017 @06:37AM
(#13722741)
This is exactly what euyyn is saying: create two files with the same SHA1 (by adding bytes of gibberish to an unused section), commit one to the repository, and now you have an collision available.