Linus on Git and SHA-1

Re:Linus on Git and SHA-1 by CalChris on Saturday February 25, 2017 @09:57PM (#13735386)

> There is, however, a performance cost in using cryptographic primitives in non-security-related contexts. You may not care about performance, but it certainly matters for something like git.

The performance difference between SHA1 and SHA256 is less than 50%. Unless hashing is a significant percentage of git, which it isn't, this is an insignificant difference.

http://atodorov.org/blog/2013/02/05/performance-test-md5-sha...

Also, you can easily argue that version control is a security context.

[ Parent | on HN ]

Re:Linus on Git and SHA-1 by bascule on Saturday February 25, 2017 @10:05PM (#13735410)

I absolutely believe git should use a cryptographically secure hash function.

But you're completely missing my point, which is about Linus's claims that git's use of SHA1 isn't security-critical, but why he's using a cryptographically secure hash function anyway.

[ Parent | on HN ]

Re:Linus on Git and SHA-1 by knweiss on Sunday February 26, 2017 @05:14AM (#13736550)

There are better cryptographic hash functions (e.g. Blake2) than SHA1 that are even faster. Check out the "results" slide of this slide deck for the cycles per byte table: https://blake2.net/acns/slides.html

[ Parent | on HN ]