Linus' reply on Git and SHA-1 collision

Re:Linus' reply on Git and SHA-1 collision by otabdeveloper on Friday February 24, 2017 @02:25AM (#13721740)

> Not saying it's easy, but now it's on the horizon.

Not really. It's not a preimage attack. They spent several hundred dollars to find two random byte strings with the same SHA1 hash. There's still no way to SHA1-collide a specific byte string instead of random junk.

[ Parent | on HN ]

Re:Linus' reply on Git and SHA-1 collision by victorNicollet on Friday February 24, 2017 @06:37AM (#13722741)

This is exactly what euyyn is saying: create two files with the same SHA1 (by adding bytes of gibberish to an unused section), commit one to the repository, and now you have an collision available.

[ Parent | on HN ]

Re:Linus' reply on Git and SHA-1 collision by mi100hael on Friday February 24, 2017 @11:01AM (#13724797)

That's not how git uses hashes. In that scenario, there would still be a diff and hence git would recognize the files were different.

[ Parent | on HN ]